URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Submission: On March 08 via api from DE — Scanned from DE

Summary

This website contacted 39 IPs in 7 countries across 28 domains to perform 124 HTTP transactions. The main IP is 2606:4700::6812:1c4a, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com. The Cisco Umbrella rank of the primary domain is 68062.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 7th 2023. Valid for: a year.
This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
21 2606:4700::68... 13335 (CLOUDFLAR...)
8 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
7 104.17.70.206 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2001:4860:480... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
11 104.85.176.46 16625 (AKAMAI-AS)
2 6 2600:9000:225... 16509 (AMAZON-02)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 152.195.15.58 15133 (EDGECAST)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 34.238.149.65 14618 (AMAZON-AES)
1 2600:9000:249... 16509 (AMAZON-02)
1 35.244.142.80 15169 (GOOGLE)
1 3.214.188.44 14618 (AMAZON-AES)
2 104.87.143.22 16625 (AKAMAI-AS)
2 2600:9000:212... 16509 (AMAZON-02)
3 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
12 18.66.15.36 16509 (AMAZON-02)
2 2001:4860:480... 15169 (GOOGLE)
2 34.111.208.231 396982 (GOOGLE-CL...)
1 37.252.171.85 29990 (ASN-APPNEX)
1 2a02:26f0:ab0... 20940 (AKAMAI-ASN1)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 2a05:d018:cc3... 16509 (AMAZON-02)
1 192.28.144.124 15224 (OMNITURE)
1 34.214.245.73 16509 (AMAZON-02)
2 44.235.191.156 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.12.117.226 16509 (AMAZON-02)
124 39
Apex Domain
Subdomains
Transfer
28 zscaler.com
www.zscaler.com — Cisco Umbrella Rank: 68062
info.zscaler.com — Cisco Umbrella Rank: 357511
890 KB
12 fullcircleinsights.com
st.fullcircleinsights.com — Cisco Umbrella Rank: 76931
12 KB
12 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6183
c.6sc.co — Cisco Umbrella Rank: 9154
ipv6.6sc.co — Cisco Umbrella Rank: 6582
b.6sc.co — Cisco Umbrella Rank: 4625
15 KB
8 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 363
131 KB
7 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2423
d.adroll.com — Cisco Umbrella Rank: 1220
23 KB
7 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 4223
www.google.com — Cisco Umbrella Rank: 2
1 KB
6 google.de
www.google.de — Cisco Umbrella Rank: 6027
948 B
6 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 28
stats.g.doubleclick.net — Cisco Umbrella Rank: 73
5 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 317
www.linkedin.com — Cisco Umbrella Rank: 556
px4.ads.linkedin.com — Cisco Umbrella Rank: 6245
3 KB
4 mountain.com
dx.mountain.com — Cisco Umbrella Rank: 6955
px.mountain.com — Cisco Umbrella Rank: 7092
gs.mountain.com — Cisco Umbrella Rank: 12349
9 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 24
20 KB
3 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 809
gw.linkedin.oribi.io — Cisco Umbrella Rank: 13082
24 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 15022
ibc-flow.techtarget.com — Cisco Umbrella Rank: 19253
2 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 41
269 KB
2 googleusercontent.com
lh4.googleusercontent.com — Cisco Umbrella Rank: 371
66 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 108
257 B
2 cloudfunctions.net
us-central1-adaptive-growth.cloudfunctions.net — Cisco Umbrella Rank: 2485
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 2859
6 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 145
137 KB
2 bing.com
bat.bing.com — Cisco Umbrella Rank: 343
12 KB
1 mktoresp.com
306-zej-256.mktoresp.com — Cisco Umbrella Rank: 717339
318 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 380
816 B
1 sf14g.com
t.sf14g.com — Cisco Umbrella Rank: 56639
1 pdst.fm
cdn.pdst.fm — Cisco Umbrella Rank: 2439
6 KB
1 cloudfront.net
d2i34c80a0ftze.cloudfront.net
11 KB
1 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 7385
32 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 686
5 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 586
295 B
124 28
Domain Requested by
21 www.zscaler.com www.zscaler.com
12 st.fullcircleinsights.com cdn.bizible.com
9 b.6sc.co
8 cdn.cookielaw.org www.zscaler.com
cdn.cookielaw.org
7 info.zscaler.com www.zscaler.com
info.zscaler.com
6 s.adroll.com 2 redirects www.googletagmanager.com
s.adroll.com
6 www.google.de www.zscaler.com
5 www.google.com www.zscaler.com
4 www.google-analytics.com www.googletagmanager.com
www.zscaler.com
www.google-analytics.com
3 px.ads.linkedin.com 2 redirects
3 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
3 googleads.g.doubleclick.net www.googletagmanager.com
3 www.googletagmanager.com www.zscaler.com
www.googletagmanager.com
2 lh4.googleusercontent.com www.zscaler.com
2 px.mountain.com dx.mountain.com
www.zscaler.com
2 www.facebook.com
2 ibc-flow.techtarget.com cdn.bizible.com
2 us-central1-adaptive-growth.cloudfunctions.net cdn.pdst.fm
2 cdn.linkedin.oribi.io snap.licdn.com
2 munchkin.marketo.net www.zscaler.com
munchkin.marketo.net
2 connect.facebook.net www.zscaler.com
connect.facebook.net
2 bat.bing.com www.googletagmanager.com
bat.bing.com
2 region1.analytics.google.com www.googletagmanager.com
1 gs.mountain.com www.zscaler.com
1 gw.linkedin.oribi.io cdn.bizible.com
1 306-zej-256.mktoresp.com munchkin.marketo.net
1 d.adroll.com s.adroll.com
1 ipv6.6sc.co cdn.bizible.com
1 c.6sc.co cdn.bizible.com
1 secure.adnxs.com cdn.bizible.com
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 t.sf14g.com www.zscaler.com
1 cdn.pdst.fm www.zscaler.com
1 d2i34c80a0ftze.cloudfront.net www.googletagmanager.com
1 dx.mountain.com www.zscaler.com
1 trk.techtarget.com www.zscaler.com
1 cdn.bizible.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 j.6sc.co www.zscaler.com
1 geolocation.onetrust.com cdn.cookielaw.org
124 41
Subject Issuer Validity Valid
www.zscaler.com
DigiCert SHA2 Extended Validation Server CA
2023-02-07 -
2024-03-09
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2022-05-01 -
2023-05-01
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
info.zscaler.com
Cloudflare Inc ECC CA-3
2022-11-08 -
2023-11-07
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
www.google.de
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
www.google.com
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
s.adroll.com
Amazon RSA 2048 M02
2023-02-24 -
2023-08-01
5 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2023-02-16 -
2023-08-16
6 months crt.sh
io.bizible.com
DigiCert TLS RSA SHA256 2020 CA1
2022-06-30 -
2023-07-31
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-01-10 -
2023-03-16
2 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-07-25 -
2023-07-25
a year crt.sh
*.mountain.com
Go Daddy Secure Certificate Authority - G2
2022-05-21 -
2023-06-22
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
cdn.pdst.fm
GTS CA 1D4
2023-01-28 -
2023-04-28
3 months crt.sh
t.sf14g.com
Go Daddy Secure Certificate Authority - G2
2022-07-11 -
2023-08-12
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-02-24 -
2023-08-06
5 months crt.sh
aws-st.fullcircleinsights.com
Amazon RSA 2048 M02
2023-02-21 -
2023-07-11
5 months crt.sh
misc.google.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh
ibc-flow.techtarget.com
GTS CA 1D4
2023-02-05 -
2023-05-06
3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
d.adroll.com
Amazon RSA 2048 M01
2022-11-08 -
2023-12-07
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.google.com
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
*.google.de
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2023-03-07 -
2023-09-07
6 months crt.sh
*.googleusercontent.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh

This page contains 3 frames:

Primary Page: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Frame ID: 000C78C95E849AAE83D5AE07175AF412
Requests: 114 HTTP requests in this frame

Frame: https://info.zscaler.com/index.php/form/XDFrame
Frame ID: 63C4BA8FD88A1E9C410C6A75C4C4DFBF
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 39E1A86CA160B5CBD33E9FA6202BD681
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

OneNote: A Growing Threat for Malware Distribution

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Page Statistics

124
Requests

97 %
HTTPS

61 %
IPv6

28
Domains

41
Subdomains

39
IPs

7
Countries

1678 kB
Transfer

4885 kB
Size

37
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1678307080432%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fonenote-growing-threat-malware-distribution%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&liSync=true&e_ipv6=AQLUR9YZ2vlv5gAAAYbC5bqRJC7N88Dy0C5GCMpw5_tBAiCsXP1XW2BNao84bfX56PO1D3s3hcVJ
Request Chain 72
  • https://s.adroll.com/j/exp/ULSJHTPGTZGY3EPPZSKHKS/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 73
  • https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js

124 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request onenote-growing-threat-malware-distribution
www.zscaler.com/blogs/security-research/
206 KB
43 KB
Document
General
Full URL
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e663bc1728001a3d1ab8c19e7dc459cc3487c1e7814bcd3d1704fd38529927a
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com; img-src 'self' https: data: blob:; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM testmydefenses.com
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
77
cache-control
max-age=31536000, public
cf-cache-status
DYNAMIC
cf-ray
7a4dcd86cb96368c-FRA
content-encoding
br
content-language
en
content-security-policy
default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com; img-src 'self' https: data: blob:; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251
content-type
text/html; charset=UTF-8
date
Wed, 08 Mar 2023 20:24:39 GMT
expires
Sun, 19 Nov 1978 05:00:00 GMT
last-modified
Wed, 08 Mar 2023 20:23:19 GMT
permissions-policy
interest-cohort=()
server
cloudflare
strict-transport-security
max-age=31536000; preload
vary
X-UA-Device,Accept-Encoding
via
varnish
x-ah-environment
prod
x-cache
HIT
x-cache-hits
4
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM testmydefenses.com
x-request-id
v-11155556-bdef-11ed-8a90-6f379a7aef33
x-ua-compatible
IE=edge
x-xss-protection
1
OtAutoBlock.js
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/
45 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/OtAutoBlock.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef401955627aaaedffd337dc3a7c4f9ad56f5dcd31f13833772760cda1aaa437
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
1BoBNuQl7UMMaO7E490CGQ==
age
36535
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6406
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:15 GMT
server
cloudflare
etag
0x8DAE80BD5AAEF51
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
2303b106-501e-014a-7ef4-19aed4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dcd8bff2b9235-FRA
expires
Thu, 09 Mar 2023 20:24:39 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
25 KB
9 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da9a77e15c8cbf2596563d3bc8020cc9e547d2b99976a0b77f5eeadf1c492feb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Ewgd1d1Vp0nFNYpIMiFTtA==
age
62358
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
8460
x-ms-lease-status
unlocked
last-modified
Tue, 07 Mar 2023 03:55:46 GMT
server
cloudflare
etag
0x8DB1EBFD503AE0E
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
61d76cec-301e-0115-3a13-515c2a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dcd8bff2f9235-FRA
google_tag.script.js
www.zscaler.com/sites/default/files/google_tag/zscaler_marketing_production/
347 B
381 B
Script
General
Full URL
https://www.zscaler.com/sites/default/files/google_tag/zscaler_marketing_production/google_tag.script.js?rr7pgi
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99b5a6256a9ee7c2640c2669ed517975bfb713b36dc3dde5c55b3c2c85885f4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
9538
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-6b59afc2-bdd5-11ed-b239-f7a1b58e7c57
last-modified
Wed, 08 Mar 2023 17:19:40 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
cf-ray
7a4dcd8c2b93368c-FRA
expires
Thu, 07 Mar 2024 17:19:44 GMT
css_NZsRhReLmcJsHvswoam3Xgy1qgq89jev--YsTfoMoZ8.css
www.zscaler.com/sites/default/files/css/
378 KB
33 KB
Stylesheet
General
Full URL
https://www.zscaler.com/sites/default/files/css/css_NZsRhReLmcJsHvswoam3Xgy1qgq89jev--YsTfoMoZ8.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
359b1185178b99c26c1efb30a1a9b75e0cb5aa0abcf637affbe62c4dfa0ca19f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
166859
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-8c3ea8f0-bc63-11ed-a715-9f3a17ce1678
last-modified
Mon, 06 Mar 2023 21:11:22 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
cf-ray
7a4dcd8bdb19368c-FRA
expires
Tue, 05 Mar 2024 21:12:05 GMT
css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
www.zscaler.com/sites/default/files/css/
462 KB
73 KB
Stylesheet
General
Full URL
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2aaa0eac6ba23ee39304a3badfb67a930293225d20cd99538e0064186ca3ee91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
226585
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-97c9546c-bbdd-11ed-8bd4-c359ecf63a7a
last-modified
Mon, 06 Mar 2023 05:13:04 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
cf-ray
7a4dcd8bdb1e368c-FRA
expires
Tue, 05 Mar 2024 05:13:12 GMT
logo.svg
www.zscaler.com/themes/custom/zscaler/
2 KB
1 KB
Image
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/logo.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb71a91ef4937bdac04520d7e7b1852bb28635ae850934d440360ccc8142c1a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
2
date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3073790
content-encoding
br
x-cache
HIT
x-ah-environment
prod
x-request-id
v-389ba100-a131-11ed-bfd3-73acc08f499c
last-modified
Thu, 22 Sep 2022 07:27:05 GMT
server
cloudflare
vary
Host, Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=31536000
cf-ray
7a4dcd8c2b94368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
3e894970-e3e9-4783-85e9-7c38eedbfbbf.json
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/3e894970-e3e9-4783-85e9-7c38eedbfbbf.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7cfd5dc386d092ab9afb5af683856ed88121e55e6bf1024333c3151ccc46e36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
StpE19/mctRp4PJx19Cb7Q==
age
47908
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1739
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:16 GMT
server
cloudflare
etag
0x8DAE80BD639ADC0
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
519b3767-a01e-0036-72f4-1975b4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dcd8c3d069be6-FRA
expires
Thu, 09 Mar 2023 20:24:39 GMT
gt-haptik-zs-regular-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
18 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-regular-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f7832c8054c16e592d3697f5612969b692ac94197aa591b5487795f7c928c1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3073665
x-cache
MISS
x-ah-environment
prod
content-length
18848
x-request-id
v-e8e4ca98-a157-11ed-a676-9fd5b0daa878
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8c5c39368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
fa-solid-900.woff2
www.zscaler.com/themes/custom/zscaler/build/webfonts/
134 KB
135 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/build/webfonts/fa-solid-900.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d23676da3d5b10007f7f675da723f274604cd88397dc25c4721519973994a71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
5
date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
2799387
x-cache
HIT
x-ah-environment
prod
content-length
137704
x-request-id
v-4907e8f8-a0ac-11ed-b332-675e65b356ce
last-modified
Thu, 22 Sep 2022 07:26:42 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8c5c3b368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
295 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9062 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7a4dcd8cdbb39a15-FRA
access-control-allow-headers
Content-Type
email-decode.min.js
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
824 B
Script
General
Full URL
https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
last-modified
Fri, 03 Mar 2023 16:16:37 GMT
server
cloudflare
content-encoding
gzip
etag
W/"64021d65-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
7a4dcd8cdced368c-FRA
expires
Fri, 10 Mar 2023 20:24:39 GMT
js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
www.zscaler.com/sites/default/files/js/
345 KB
113 KB
Script
General
Full URL
https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab064f552d9f6c01de22431e5ffa4dec46c5fea8c2ecda8d5cd3b8573863308b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
226585
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-97d4cb44-bbdd-11ed-83e5-6380eb2be68b
last-modified
Mon, 06 Mar 2023 05:13:04 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000
cf-ray
7a4dcd8cecee368c-FRA
expires
Tue, 05 Mar 2024 05:13:12 GMT
forms2.min.js
info.zscaler.com/js/forms2/js/
208 KB
69 KB
Script
General
Full URL
https://info.zscaler.com/js/forms2/js/forms2.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
5020
etag
"340d43-33e51-5f217594de500"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7a4dcd8dcc2f2bc2-FRA
expires
Thu, 09 Mar 2023 00:24:39 GMT
js_bs8YJ93pC4zs7puF5kViK1HmmxKyuhrk1IT8C57y-EI.js
www.zscaler.com/sites/default/files/js/
149 KB
41 KB
Script
General
Full URL
https://www.zscaler.com/sites/default/files/js/js_bs8YJ93pC4zs7puF5kViK1HmmxKyuhrk1IT8C57y-EI.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ecf1827dde90b8cecee9b85e645622b51e69b12b2ba1ae4d484fc0b9ef2f842
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3068916
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-442371a0-a1ff-11ed-9c9b-979a585b96ff
last-modified
Wed, 01 Feb 2023 07:08:05 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000
cf-ray
7a4dcd8cecf0368c-FRA
expires
Thu, 01 Feb 2024 07:08:45 GMT
blog-subscription-form-background%401x.jpeg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/page/blog/
8 KB
8 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/page/blog/blog-subscription-form-background%401x.jpeg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe40bb752bab0a83fce103714fcd294ebc51314978fd77c81fe1842d1452df80
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
8021
cf-resized
internal=ok/h q=0 n=16+0 c=2+319 v=2023.2.1 l=8021
last-modified
Fri, 09 Dec 2022 08:42:57 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cftz37uaFigiYaqZiowwIKFZQi1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8cecf2368c-FRA
gt-haptik-zs-bold-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
19 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-bold-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a83018a0ad67600ad05abd4fb02932d92e620f065ea461628d51607b644bd363
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
1
date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3076564
x-cache
HIT
x-ah-environment
prod
content-length
19652
x-request-id
v-e8352a70-a157-11ed-96e2-c3a34c6dfaba
last-modified
Thu, 22 Sep 2022 07:26:42 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8cecf4368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
fa-brands-400.woff2
www.zscaler.com/themes/custom/zscaler/build/webfonts/
74 KB
74 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/build/webfonts/fa-brands-400.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79e40ce5098ca3d5d3ed476b2b4e156829bdec21fb8c07bab967f6525f5c5677
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
1
date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
2812113
x-cache
HIT
x-ah-environment
prod
content-length
76008
x-request-id
v-e87886a8-a157-11ed-8619-f73854114736
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8cecf5368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.39.0/
372 KB
89 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Zp/CcrZmK7hQ2S6c/t9Tpw==
age
10703
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
90454
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:31:04 GMT
server
cloudflare
etag
0x8DA87805EB35DE2
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
41a1e322-301e-0173-6402-efee70000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dcd8d18969235-FRA
home-footer-background@2x.jpg
www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/footer/
86 KB
87 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/footer/home-footer-background@2x.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799750d012928b7eb93488d34a353144910f18087bfd3a0e1519fc14c15a621b
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
88359
cf-resized
internal=ok/e q=0 n=64+0 c=11+287 v=2023.1.3 l=88359
last-modified
Thu, 22 Sep 2022 07:26:42 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
"cfmAYWApYxRua061OS8bD05wi41gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
warning
cf-images 299 "image too large for AVIF", cf-images 299 "original is 6727B smaller"
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8d1d37368c-FRA
gt-haptik-zs-medium-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
19 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-medium-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0026207a95ec76029445ec7fd6eda7a06dfb1778cb84464e36f661711db17ea4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
1
date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3073666
x-cache
HIT
x-ah-environment
prod
content-length
19504
x-request-id
v-e83517e2-a157-11ed-b50c-4b8c5d713c3a
last-modified
Thu, 22 Sep 2022 07:26:19 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8d1d3b368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
fail-over.js
www.zscaler.com/
0
122 B
XHR
General
Full URL
https://www.zscaler.com/fail-over.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
2807536
x-cache
MISS
x-ah-environment
prod
content-length
0
x-request-id
v-e890de1a-a157-11ed-b8b2-37684c93071f
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8d4d8b368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
fail-over.js
www.zscaler.com/
0
45 B
Script
General
Full URL
https://www.zscaler.com/fail-over.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
2807536
x-cache
MISS
x-ah-environment
prod
content-length
0
x-request-id
v-e890de1a-a157-11ed-b8b2-37684c93071f
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8d6def368c-FRA
expires
Thu, 07 Mar 2024 20:24:39 GMT
phishing-spam-2%402x.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blogs/----category-images/phishing-spam/
37 KB
38 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blogs/----category-images/phishing-spam/phishing-spam-2%402x.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d1f4dc8f57f1369b2c6e76000c2aa140c684b60459c7f09f4baa7103d14b8a8
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
38371
cf-resized
internal=ok/h q=0 n=12+228 c=0+0 v=2023.2.4 l=38371
last-modified
Fri, 04 Sep 2020 11:16:11 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cfX0La5_rO0woqb2I4kGLlGM7p1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8d9e51368c-FRA
en.json
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/57d0b2fd-5e95-4e1b-923d-cff7f0c71c9e/
76 KB
15 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/57d0b2fd-5e95-4e1b-923d-cff7f0c71c9e/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
69fe3a3cb8e52c9522e1317a41bfda30f19e6c199fb84c66f083cd9e35e46442
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
a+O//X2h08gSfqxZ78vXYQ==
age
24918
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
15164
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:17 GMT
server
cloudflare
etag
0x8DAE80BD6BFBADE
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
89be1b07-701e-00f3-1cf4-190b8f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dcd8d9f519be6-FRA
expires
Thu, 09 Mar 2023 20:24:39 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Xx897lTVYGjMQiwuGCrzDA==
age
27753
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
3007
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:30:55 GMT
server
cloudflare
etag
0x8DA87805972EF22
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
6e038401-f01e-012a-24f6-e1ebf6000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dcd8ddfa99be6-FRA
otCookieSettingsButton.json
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
5 KB
2 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCookieSettingsButton.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ssl6Phwu9+sah2W05EtyUQ==
age
28752
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1767
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:30:57 GMT
server
cloudflare
etag
0x8DA87805A8DD1F0
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
dfb40754-401e-0155-80f6-e175c4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dcd8ddfac9be6-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
22 KB
5 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
B55i3ZY9miZIaUrwjufy0w==
age
24918
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:31:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
dfb3fa52-401e-0155-4af6-e175c4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
7a4dcd8ddfaf9be6-FRA
gtm.js
www.googletagmanager.com/
411 KB
111 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/google_tag/zscaler_marketing_production/google_tag.script.js?rr7pgi
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
35ee3c0ae3f5a52f211788bbcd368094fbdfbe1b489245bc8949e68f3bd54d5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
113707
x-xss-protection
0
last-modified
Wed, 08 Mar 2023 19:56:24 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 08 Mar 2023 20:24:39 GMT
getForm
info.zscaler.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=1944&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&callback=jQuery1124021304568996643392_1678307079368&_=1678307079369
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9be5ede9e1340002dc27657c572cfba606bacf962e4d4f15b244a44a8748df55

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7a4dcd8e5d252bc2-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
getForm
info.zscaler.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=7140&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&callback=jQuery1124021304568996643392_1678307079370&_=1678307079371
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2de67a71099717228816ba0d42a98621ece6856c97005ab956f749c0bfd8911b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-form-service-request-id
6994#186c2e5b685
x-marketo-source
Form Service
cf-ray
7a4dcd8e5d262bc2-FRA
cached
false
zscaler-company-blogs-seconday-hero-secure-the-workforce%402x.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/blog-hero/
22 KB
22 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/blog-hero/zscaler-company-blogs-seconday-hero-secure-the-workforce%402x.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
979fad71a30e04878ea6f208924e89593d93fac949e1ddcdd824e265d840b32e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
22456
cf-resized
internal=ok/h q=0 n=13+0 c=6+140 v=2023.2.6 l=22456
last-modified
Fri, 06 Nov 2020 06:04:35 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfr924Qcc40f4MnRBiOK27oTqo1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
warning
cf-images 299 "image too large for AVIF"
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd8e5fe8368c-FRA
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
forms2.css
info.zscaler.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://info.zscaler.com/js/forms2/css/forms2.css
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63113904
cf-cache-status
HIT
age
767
content-length
2623
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
etag
"340d3b-3437-5f217594de500"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7a4dcd8ede0f2bc2-FRA
expires
Thu, 09 Mar 2023 00:24:39 GMT
forms2-theme-round.css
info.zscaler.com/js/forms2/css/
4 KB
1 KB
Stylesheet
General
Full URL
https://info.zscaler.com/js/forms2/css/forms2-theme-round.css
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
767
etag
"340d3a-e46-5f217594de500"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7a4dcd8ede112bc2-FRA
content-length
968
expires
Thu, 09 Mar 2023 00:24:39 GMT
XDFrame
info.zscaler.com/index.php/form/ Frame 63C4
2 KB
873 B
Document
General
Full URL
https://info.zscaler.com/index.php/form/XDFrame
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7a4dcd8f4eca2bc2-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 08 Mar 2023 20:24:39 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/?random=1678307079652&cv=11&fst=1678307079652&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&auid=1457898848.1678307080&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ca2cd7c4ec81e61384542eee07160860dad9a7afd45ef5dd2d09b5cfacbe316
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1241
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 08 Mar 2023 20:14:50 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
589
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Wed, 08 Mar 2023 22:14:50 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1678307079660&cv=11&fst=1678307079660&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&auid=1457898848.1678307080&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1ea34bd4a6b3dc4f37d57942239fe7c5afb5e3c123e290f99bb840ea2b2a992a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1243
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/
253 KB
84 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
eab8ca218eeaea15b474b1be7f747a6908682949737059154f1bd428c45f8a50
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
85663
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 08 Mar 2023 20:24:39 GMT
collect
stats.g.doubleclick.net/j/
4 B
349 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-6177009-1&cid=2096378197.1678307080&jid=434263295&gjid=270082414&_gid=1553043268.1678307080&_u=YGBAiEABBAAAAEAAI~&z=667366492
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 08 Mar 2023 20:24:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
194 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j99&a=1052230717&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&ul=en-us&de=UTF-8&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAiEABBAAAAAAAI~&jid=434263295&gjid=270082414&cid=2096378197.1678307080&tid=UA-6177009-1&_gid=1553043268.1678307080&gtm=45He3360n715SLZFK&z=624787760
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 10:57:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
34046
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
254 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je3360&_p=1052230717&_gaz=1&cid=2096378197.1678307080&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1678307079&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&en=page_view&_fv=1&_ss=1&ep.allowLinker=true&ep.cookieDomain=auto
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
56 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-10SPJ4YJL9&cid=2096378197.1678307080&gtm=45je3360&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-10SPJ4YJL9&cid=2096378197.1678307080&gtm=45je3360&aip=1&z=1619392726
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=2096378197.1678307080&jid=434263295&_u=YGBAiEABBAAAAEAAI~&z=9624175
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=2096378197.1678307080&jid=434263295&_u=YGBAiEABBAAAAEAAI~&z=9624175
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/973777747/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/973777747/?random=1678307079652&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=3103481651&rmt_tld=0&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/973777747/
42 B
455 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/973777747/?random=1678307079652&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=3103481651&rmt_tld=1&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/812494211/
42 B
108 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/812494211/?random=1678307079660&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=2160841636&rmt_tld=0&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/812494211/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/812494211/?random=1678307079660&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=2160841636&rmt_tld=1&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
forms2.min.js
info.zscaler.com/js/forms2/js/ Frame 63C4
208 KB
69 KB
Script
General
Full URL
https://info.zscaler.com/js/forms2/js/forms2.min.js
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://info.zscaler.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
5020
etag
"340d43-33e51-5f217594de500"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7a4dcd91eb202bc2-FRA
expires
Thu, 09 Mar 2023 00:24:39 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j99&a=1052230717&t=timing&_s=2&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&ul=en-us&de=UTF-8&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=2148&pdt=158&dns=44&rrt=0&srt=804&tcp=20&dit=1253&clt=1253&_gst=1524&_gbt=1585&_u=YGBAiEABBAAAAEAAI~&jid=&gjid=&cid=2096378197.1678307080&tid=UA-6177009-1&_gid=1553043268.1678307080&gtm=45He3360n715SLZFK&z=933478833
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 10:56:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
34087
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
4 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1052230717&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&ul=en-us&de=UTF-8&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Engagement&ea=10%25&el=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&_u=aGDACEABBAAAAGAAI~&jid=1172035126&gjid=1668654245&cid=2096378197.1678307080&tid=UA-6177009-1&_gid=1553043268.1678307080&_r=1&_slc=1&gtm=45He3360n715SLZFK&z=1412797030
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
6si.min.js
j.6sc.co/
33 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 09 Feb 2023 18:18:39 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63e538ff-820b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
10438
expires
Wed, 08 Mar 2023 20:24:40 GMT
roundtrip.js
s.adroll.com/j/
57 KB
19 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4bceb9f32efde2d668a8d95c0a9ac403bb83e3fd48e8d4b91bda4855910963fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
CKFhTaQFx2V3ldZqcsFc4q9le912SObA
Content-Encoding
gzip
Via
1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
Date
Wed, 08 Mar 2023 19:30:35 GMT
Age
3246
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Thu, 23 Feb 2023 21:36:59 GMT
Server
AmazonS3
Etag
W/"8ae4154f2f795bd765a3220cec1127fe"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
8s7FbgY0llB21gATj_1CPHXeLYVTTiTKjFodIGYtTl-c0ZVzHaJOkg==
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=29313
accept-ranges
bytes
content-length
4777
bat.js
bat.bing.com/
40 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Wed, 08 Mar 2023 20:24:40 GMT
last-modified
Thu, 16 Feb 2023 18:31:53 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 1884C3E93495404BAA2077CF66F86A8A Ref B: FRAEDGE1519 Ref C: 2023-03-08T20:24:40Z
etag
"8072cff03442d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
11894
bizible.js
cdn.bizible.com/scripts/
83 KB
32 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
1ae740ebbe1a0c68cdf60b2d5df40126d47e6c69d19bf794b8a99ad5ceb81992

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
gzip
last-modified
Sat, 04 Mar 2023 02:07:06 GMT
server
ECS (frb/67D4)
age
75985
etag
"548fe53e4ed91:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
32327
fbevents.js
connect.facebook.net/en_US/
110 KB
28 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
52aef2e29527ef32fc04e0f34c0e20411e03a575b45f25f939f1932a1069efbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 08 Mar 2023 20:24:40 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
28397
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
pWRb3DQingX+CnhlAOjPXurpykESPEXzcJuAVm78KeInF86qvS8yke7y3P1ngrsx/aqkN/XGk553GfymZQd8hA==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-trip-id
2050670934
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c9f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
server
cloudflare
age
394
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=1200
cf-ray
7a4dcd946a426939-FRA
expires
Wed, 08 Mar 2023 20:28:06 GMT
spx
dx.mountain.com/
15 KB
4 KB
Script
General
Full URL
https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=49249985280219240term=value
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.238.149.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-238-149-65.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
58f940a590945336956edbe4a07edb6f55fb69602c24a22face9b35896b2bf2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
gzip
server
istio-envoy
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
x-envoy-upstream-service-time
2
be
spx-prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
fullcircle.js
d2i34c80a0ftze.cloudfront.net/
31 KB
11 KB
Script
General
Full URL
https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=731c316a-c46e-4a94-81a9-7cfc0ea0d53e&domain=zscaler.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:ba00:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
df26e59b0ea17beea7651010590153fdbee9f22a8d12315e8e9c3cc6973fcb22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 01:21:09 GMT
via
1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront), 1.1 ab68583a58d574d6a9e5fca1fb1e6316.cloudfront.net (CloudFront)
content-encoding
gzip
x-amz-cf-pop
FRA6-C1, FRA56-P6
age
68611
x-amzn-requestid
adb53740-549e-4912-9e99-71e683a746c5
x-amzn-trace-id
Root=1-6407e305-7022e2cc5f56da78176ccf8c;Sampled=0
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amz-apigw-id
BcBo1G86vHcFnpw=
x-amz-cf-id
1QWNIV84Nn4x_tmN185Zmh0IFNveW-dFVBaXJ2XOOVTkfz-c87a7CA==
ping.min.js
cdn.pdst.fm/
26 KB
6 KB
Script
General
Full URL
https://cdn.pdst.fm/ping.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
80.142.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 19:33:49 GMT
content-encoding
gzip
age
3051
x-guploader-uploadid
ADPycdvQY3X4ogmytj-LviwmLp0y0su9_4yZIIIXNGKvhja3i8NC74ItlgGFI74Wgl-fmHKrGHT8pTHNcL_U4HQ77jSNTg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5774
last-modified
Fri, 28 May 2021 20:34:03 GMT
server
UploadServer
etag
"d001d1c9f5a942fa5524eeacb047e819"
vary
Accept-Encoding
x-goog-generation
1622234043862937
x-goog-hash
crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
5774
accept-ranges
bytes
content-type
application/javascript;
expires
Wed, 08 Mar 2023 20:33:49 GMT
js
www.googletagmanager.com/gtag/
217 KB
74 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-812494211
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ee1bb260c49407f450278f03b23aadf996a27c44935a645c66e4044234badd03
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
75287
x-xss-protection
0
last-modified
Wed, 08 Mar 2023 19:56:24 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 08 Mar 2023 20:24:40 GMT
sf14g.js
t.sf14g.com/
0
0
Script
General
Full URL
https://t.sf14g.com/sf14g.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.214.188.44 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-188-44.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.87.143.22 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-87-143-22.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
ef2ca5ac3d9cf4d005d7294562694e44b40efd2c194722721a52743c2f43f1a6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Wed, 08 Mar 2023 20:24:40 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Mar 2023 02:09:07 GMT
Server
AkamaiNetStorage
ETag
"fefdb331ffca929fc0e661337b64ed4f:1678241347.158405"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
741
collect
stats.g.doubleclick.net/j/
4 B
70 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-6177009-1&cid=2096378197.1678307080&jid=1172035126&gjid=1668654245&_gid=1553043268.1678307080&_u=aGDACEABBAAAAGAAI~&z=2009199266
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 08 Mar 2023 20:24:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=2096378197.1678307080&jid=1172035126&_u=aGDACEABBAAAAGAAI~&z=1385144972
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=2096378197.1678307080&jid=1172035126&_u=aGDACEABBAAAAGAAI~&z=1385144972
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1778897272132032
connect.facebook.net/signals/config/
381 KB
109 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1778897272132032?v=2.9.98&r=canary
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b676116353f4fc61b28c4305cd66e29e6425b9718b21ea0341987db6aa0850f4
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Wed, 08 Mar 2023 20:24:40 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
dAMgsUwV/X+/V5/2T3cGeoWIhlOdS7Ak7rOgqwfAfDsRbQI6050aU+E9PHGxxwQFVaXAuA53Iw1MsvpMyTyDXQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-trip-id
2050670934
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
token
cdn.linkedin.oribi.io/partner/33962/domain/zscaler.com/
38 B
377 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/33962/domain/zscaler.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:2000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
9581d252706f6236028acf67e89cd0c2f8ec64ff46a416bf384b2fd3876080d4

Request headers

Accept
*
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:01:54 GMT
content-encoding
gzip
via
1.1 8197d89da72990bb606996d5e7c73ab6.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
age
1366
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
1ER9nLBi2VT9HoiLRcbE_AGBeN9s8lbbpTo5Nq_2ruRmX3EPqSUVrw==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1678307080432%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblog...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&liSync=true&...
0
264 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&liSync=true&e_ipv6=AQLUR9YZ2vlv5gAAAYbC5bqRJC7N88Dy0C5GCMpw5_tBAiCsXP1XW2BNao84bfX56PO1D3s3hcVJ
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 9649F9265C554858994E40CE3F51938C Ref B: FRAEDGE1415 Ref C: 2023-03-08T20:24:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2aVFjaP0hdF4JZ62VNg==

Redirect headers

date
Wed, 08 Mar 2023 20:24:40 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 2F2871482CFE4C1F8C66B3435D2E7A03 Ref B: FRAEDGE1114 Ref C: 2023-03-08T20:24:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678307080432&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&liSync=true&e_ipv6=AQLUR9YZ2vlv5gAAAYbC5bqRJC7N88Dy0C5GCMpw5_tBAiCsXP1XW2BNao84bfX56PO1D3s3hcVJ
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2aVFgqNipgtLfdWBV2Q==
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/ULSJHTPGTZGY3EPPZSKHKS/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
785 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Server
2600:9000:225e:a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
vl4sIq5L75I77eKRxMdoJ1ZCUifm_NK5
Date
Wed, 08 Mar 2023 01:47:44 GMT
Via
1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
Age
67025
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Thu, 02 Mar 2023 00:16:22 GMT
Server
AmazonS3
Etag
"5816cced8568d223aa09d889f300692b"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
i-sQIp2PljwPtfz6xVHOA3F0q4PfnuKauJ3E9dVIVsMjv-pEOtwsTw==

Redirect headers

Date
Wed, 08 Mar 2023 06:52:37 GMT
Via
1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
Age
48723
X-Amz-Cf-Pop
FRA60-P4
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
KwRSNnHR9oB2_OdLiyEH2SOGSrrwKymZbe43Uex69VmtCE3Rtm9T3g==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
756 B
Script
General
Full URL
https://s.adroll.com/j/pre/index.js
Protocol
HTTP/1.1
Server
2600:9000:225e:a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Date
Wed, 08 Mar 2023 00:39:04 GMT
Via
1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
Age
71136
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
jMUiunAf9GBmHxXGTKk1Wbs9MMdE-2TFLlDYNrlTJLEIvB-9mQ2HGQ==

Redirect headers

Date
Wed, 08 Mar 2023 06:58:58 GMT
Via
1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
Age
48341
X-Amz-Cf-Pop
FRA60-P4
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
WktdWpsApZTH3T7_jCPIw9nSlgEPzU9hiZZipSidJPvIeANNFmLPgA==
index.js
s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/
0
808 B
Script
General
Full URL
https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
hJkD9OBQgUxq8wryMQzTIgzdUJcjExH3
Date
Wed, 08 Mar 2023 20:12:22 GMT
Via
1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
Age
767
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Sat, 04 Mar 2023 22:02:31 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
bQissbwIf3L69XI-fdnPr3qKB1rVk5dofzwFMnv9523S0Ytdk1mdjw==
26354555.js
bat.bing.com/p/action/
0
135 B
Script
General
Full URL
https://bat.bing.com/p/action/26354555.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Wed, 08 Mar 2023 20:24:40 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 0D9D1809478C4588875F272566FFEFC0 Ref B: FRAEDGE1519 Ref C: 2023-03-08T20:24:40Z
x-powered-by
ARR/3.0
x-cache
CONFIG_NOCACHE
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash
e117e172395b5b6cbb254e50f7848ecbbf91c4d612c061fdea14127818518193

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:24:41 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-P1
x-amzn-trace-id
Root=1-6408ef09-35d16b4c45a8de8e5d6927e9;Sampled=0
x-amzn-requestid
079e875b-d648-450a-bef0-42682458b59f
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
BepJfEDjPHcF4ZQ=
content-length
1406
x-amz-cf-id
g7Xoq6LgZpMIiOUDrJA5pcGNGhpq85WQJOeJp470JpZgxHvvJIGnZw==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:24:40 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-apigw-id
BepJZHErPHcFcwg=
x-amz-cf-id
uzqZVwJ4bqQ55ACFTxriWaulEO-LaKEnUa-HAhTNBQjO1CHekP3Gsw==
x-amz-cf-pop
VIE50-P1
x-amzn-requestid
894e2fd3-8929-4afe-98b6-534b3c155575
x-cache
Miss from cloudfront
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/
0
0
Fetch
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by
Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
application/json
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
server
Google Frontend
x-powered-by
Express
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
access-control-allow-methods
GET, POST
content-type
text/html
access-control-allow-origin
*
x-cloud-trace-context
d4b9fc1759c153cb66f75d96ab6c3b3a
function-execution-id
t6l58vaez5c9
access-control-allow-headers
Content-Type, Accept
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame
0
0
Preflight
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type, Accept
access-control-allow-methods
GET, POST
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
22
content-type
text/html; charset=utf-8
date
Wed, 08 Mar 2023 20:24:40 GMT
etag
W/"2-ROqGvmcGDXooyAXFZHZ+i4au1yQ"
function-execution-id
pzbdv0zwnjg1
server
Google Frontend
x-cloud-trace-context
7b0641beaff1aa14b7f65c572433f73d
x-powered-by
Express
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash
6bc6239f7eedfec4190603cddea7e514b8f7d26bac8524dc1fea126321f43d0f

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:24:41 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-P1
x-amzn-trace-id
Root=1-6408ef09-7bede54f13c5891458bb4b9d;Sampled=0
x-amzn-requestid
10d9a543-6236-4c1b-b849-29ae35817f31
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
BepJiFuOPHcF5vQ=
content-length
1406
x-amz-cf-id
RnoEh5I1i2MQ0cmyDeSH_rc40xsTFB36p5Zlsg7eUxds3lYteVaHvg==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:24:40 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-apigw-id
BepJcGyIPHcFvBQ=
x-amz-cf-id
zu5rokMCcAkZeLwoBSRYNLcrBYQCY4eJdesMMVdSpAA29tIabgsD5Q==
x-amz-cf-pop
VIE50-P1
x-amzn-requestid
07e25091-af6b-46e5-b3cf-bba2cfc554ef
x-cache
Miss from cloudfront
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash
0adad532f06f7ebc4c00a0583967864cfa69363984e8f440c05ff53cd6ed3392

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:24:41 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-P1
x-amzn-trace-id
Root=1-6408ef09-03ec8f5e28435d8365ae0c6f;Sampled=0
x-amzn-requestid
609f5db8-f48e-498c-87d7-7753707f1b3d
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
BepJhFvVvHcF1Tg=
content-length
1406
x-amz-cf-id
u4oq4539pF6ta24JalRmmWI9ePDJUAXkVWal1gPK1qjlugSOTyMYlw==
gif.gif
ibc-flow.techtarget.com/a/
43 B
471 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2334982&r=1678307080470&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&version=2.4
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
2334982
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
via
1.1 google
x-guploader-uploadid
ADPycdvYyCsM_53ybdfXcHdz9BJDJL6B2X9bCdglzbDLomCUb5ncgENHM_PR41CYx5nrffWWYE9xQANdxfyB3HOoPvVhPKJLS570
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Wed, 08 Mar 2023 21:24:40 GMT
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:24:40 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-apigw-id
BepJcE1QvHcF_Jg=
x-amz-cf-id
YDJQd46ZocjNMW22UUfU_Li_BasXBfdhC5TT7PqKfZHwb3Wt7cX1EA==
x-amz-cf-pop
VIE50-P1
x-amzn-requestid
fbe79dc9-f5b9-4632-b7a9-e75d5a8539ea
x-cache
Miss from cloudfront
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2334982&r=1678307080470&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 08 Mar 2023 20:24:40 GMT
expires
Wed, 08 Mar 2023 20:24:40 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
ADPycdsyMR2Ob1LYBMrPUX_5BDOJvSlKdznwJ3BHQKuSaf7fwNPHXQRL3tZLh0i9uT3OXPsjR0mxcPltYecWo_-d2TlwmtXmtK7G
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1678307080487&cv=11&fst=1678307080487&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&auid=1457898848.1678307080&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7cb22bf625a50aae649fa06df4af355caeab6f0078a9aa509f83b989c4a963ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1261
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
getuidj
secure.adnxs.com/
11 B
816 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.171.85 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Mar 2023 20:24:40 GMT
AN-X-Request-Uuid
a89fe4ac-fc80-4203-97c5-2a4a325aef58
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zscaler.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
37.58.58.243; 37.58.58.243; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
202 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.zscaler.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
23 B
314 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:ab00:39d::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
8636e97cded227990a8dfe7f4c866491216d08dfef3d8645ee12d1576c301ef6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.zscaler.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a00:c98:2030:a004:1::6
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466196_34901535_67782235_22_980_6_0";dur=1
content-length
23
expires
Wed, 08 Mar 2023 20:24:40 GMT
munchkin.js
munchkin.marketo.net/162/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.87.143.22 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-87-143-22.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Wed, 08 Mar 2023 20:24:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4677
Expires
Fri, 16 Jun 2023 20:24:40 GMT
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1778897272132032&ev=PageView&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&rl=&if=false&ts=1678307080525&sw=1600&sh=1200&v=2.9.98&r=canary&ec=0&o=30&ttf=2388&tts=2245.4000000953674&ttse=2386.0999999046326&cs_est=true&fbp=fb.1.1678307080524.1093717080&it=1678307080385&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Wed, 08 Mar 2023 20:24:40 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
oribili.js
cdn.linkedin.oribi.io/33962/
72 KB
24 KB
Script
General
Full URL
https://cdn.linkedin.oribi.io/33962/oribili.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:2000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
9425e201802508d3508b64c3a5d9e7443d268271ed9536a5fadc2961ec633afa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:23:21 GMT
content-encoding
gzip
via
1.1 97101640da3dcba7a2d4a3d67a31b114.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
age
79
vary
accept-encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript;charset=UTF-8
cache-control
public, max-age=300
x-amz-cf-id
Rg-B0NMfbWmZde0RLqjXMZPY5RsYjcbsJOfsfV9GsBK4GzRjAB8IGw==
ULSJHTPGTZGY3EPPZSKHKS
d.adroll.com/consent/check/
463 B
556 B
Script
General
Full URL
https://d.adroll.com/consent/check/ULSJHTPGTZGY3EPPZSKHKS?pv=59771771048.57685&arrfrr=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&_s=5ad37190cb42c3606acafdb4101d9238&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe04:8902:5bff:76db:b5d5 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
0750e83b0c29c463b422d3d38110eac0790cb2c550817da81476207049af840b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
server
nginx/1.22.1
content-length
463
content-type
application/javascript
visitWebPage
306-zej-256.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://306-zej-256.mktoresp.com/webevents/visitWebPage?_mchNc=1678307080558&_mchCn=&_mchId=306-ZEJ-256&_mchTk=_mch-zscaler.com-1678307080557-98784&_mchHo=www.zscaler.com&_mchPo=&_mchRu=%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Wed, 08 Mar 2023 20:24:40 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
4d60d272-a20d-4bd5-9809-adb1b26793c9
/
www.google.com/pagead/1p-user-list/812494211/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/812494211/?random=1678307080487&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=609693529&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/812494211/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/812494211/?random=1678307080487&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=609693529&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:40 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
event
gw.linkedin.oribi.io/
0
186 B
XHR
General
Full URL
https://gw.linkedin.oribi.io/event
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.214.245.73 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-214-245-73.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.zscaler.com
date
Wed, 08 Mar 2023 20:24:41 GMT
access-control-allow-credentials
true
content-length
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain
/
px.ads.linkedin.com/ws_collect/
0
143 B
Image
General
Full URL
https://px.ads.linkedin.com/ws_collect/?pid=33962&timestamp=1678307080638&raw_event_id=33962-322f377f-ce83-981e-2312-fc899cca96dd-1678307080635
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:39 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 2F64CBE09947438B87F22EAD1B4F907F Ref B: FRAEDGE1114 Ref C: 2023-03-08T20:24:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2aVFerHf++9wniNiTGg==
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2030%3Aa004%3A1%3A%3A6%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A40%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2008%20Mar%202023%2020%3A24%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22ab9750bca4342498694e239e304dd3a9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2008%20Mar%202023%2020%3A24%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2008%20Mar%202023%2020%3A24%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
89e38b9d-7f92-4804-9527-0b0ce79f0995
https://www.zscaler.com/
43 B
0
Image
General
Full URL
blob:https://www.zscaler.com/89e38b9d-7f92-4804-9527-0b0ce79f0995
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
st
px.mountain.com/
2 KB
2 KB
Script
General
Full URL
https://px.mountain.com/st?ga_tracking_id=UA-6177009-1&ga_client_id=2096378197.1678307080&shpt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-6177009-1%22%2C%22ga_client_id%22%3A%222096378197.1678307080%22%2C%22shpt%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%2C%22dcm_cid%22%3A%221678307079.1%22%2C%22dcm_gid%22%3A%221553043268.1678307080%22%2C%22mntnis%22%3A%7B%7D%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=1678307079.1&dcm_gid=1553043268.1678307080&dxver=4.0.0&shaid=32329&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=49249985280219240term%3Dvalue&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Clanguage%3Den&shoid=%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution
Requested by
Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=49249985280219240term=value
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
44.235.191.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-235-191-156.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e47550d3a9b75cf85fa47a9f7da13fd2bd3b89dd457fa3c7594da480786f3fbb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:41 GMT
content-encoding
gzip
server
istio-envoy
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
x-envoy-upstream-service-time
1
connection
close
/
www.facebook.com/tr/ Frame 39E1
0
72 B
Document
General
Full URL
https://www.facebook.com/tr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.zscaler.com
Referer
https://www.zscaler.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.zscaler.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Wed, 08 Mar 2023 20:24:41 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
lh4.googleusercontent.com/
33 KB
33 KB
Image
General
Full URL
https://lh4.googleusercontent.com/MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
a8079038523e0b4ee4788120fe71f2132b3fdb347428f1f9dd365fecbb794622
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:06:34 GMT
x-content-type-options
nosniff
age
1087
content-disposition
inline;filename="onenote.JPG"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33364
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Fri, 03 Mar 2023 02:34:48 GMT
MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
lh4.googleusercontent.com/
33 KB
33 KB
Image
General
Full URL
https://lh4.googleusercontent.com/MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
a8079038523e0b4ee4788120fe71f2132b3fdb347428f1f9dd365fecbb794622
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:06:34 GMT
x-content-type-options
nosniff
age
1087
content-disposition
inline;filename="onenote.JPG"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33364
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Fri, 03 Mar 2023 02:34:48 GMT
zscaler-promo-thumb-modernWorkEnab.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/
8 KB
8 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/zscaler-promo-thumb-modernWorkEnab.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85813f6ca8ca7fc81a8ae31d69ac4254d0b4dda08b70f4fe8f2056fda3a0c78f
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:41 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
7981
cf-resized
internal=ok/e q=0 n=72+0 c=0+247 v=2023.1.3 l=7981
last-modified
Sat, 21 Aug 2021 19:51:35 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cf6B-fEO6jNYiOpMtMe5e7DBEe1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd9b0be0368c-FRA
queue
st.fullcircleinsights.com/v1/visits/
2 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash
844b63ad71315eec490c93ee1f0dcbb615710619fa376ef4a608f42efb27ca5f

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:24:42 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-P1
x-amzn-trace-id
Root=1-6408ef0a-5d24896b28e3d72309de00bb;Sampled=0
x-amzn-requestid
a17a0605-2415-4a5e-b430-82e963386405
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
BepJrGiwPHcFx5Q=
content-length
2050
x-amz-cf-id
0W1JESGxjVS6rgLM4IsIyK7RUNYOvycZXkuaaAC3eXS5tWgxNkeinw==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:24:41 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-apigw-id
BepJmE12vHcFU2Q=
x-amz-cf-id
UngZYH4X1pUwTjBxCtjRqZwMpUfvQEhaUfKVTvCxLjHKcIKf-Aq8rw==
x-amz-cf-pop
VIE50-P1
x-amzn-requestid
368e2914-5aa2-4838-af78-5d26a3934dd0
x-cache
Miss from cloudfront
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A40%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
zscaler-promo-thumb-modernWorkEnab.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/
8 KB
8 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/zscaler-promo-thumb-modernWorkEnab.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85813f6ca8ca7fc81a8ae31d69ac4254d0b4dda08b70f4fe8f2056fda3a0c78f
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:41 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
7981
cf-resized
internal=ok/e q=0 n=72+0 c=0+247 v=2023.1.3 l=7981
last-modified
Sat, 21 Aug 2021 19:51:35 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cf6B-fEO6jNYiOpMtMe5e7DBEe1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dcd9bbcda368c-FRA
queue
st.fullcircleinsights.com/v1/visits/
2 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash
4df81545b0f6aadb4bcf499cc2afd833e4047b40f4dc5ff9d3bb35ed84abebd9

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:24:42 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-P1
x-amzn-trace-id
Root=1-6408ef0a-702ef08e5511d8e377caeb8a;Sampled=0
x-amzn-requestid
6a99f889-c628-4754-ba50-0e3e0098e9d3
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
BepJvFCnvHcFyNQ=
content-length
2050
x-amz-cf-id
jOFY6FETdbzgFJyB5QPv9OSTgLKlm6iY7BOkuTqod9cJHR14oVxxzQ==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:24:42 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-apigw-id
BepJoHGhvHcF9eA=
x-amz-cf-id
bscxkONEaRXCPR0GV71jtp-a9igUSpZxWFAsGP8KWGUEI7F2gCs7-Q==
x-amz-cf-pop
VIE50-P1
x-amzn-requestid
02337ac4-8998-49b5-a78b-0b1f8c618a08
x-cache
Miss from cloudfront
queue
st.fullcircleinsights.com/v1/visits/
2 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash
e022d964d4f870719a7e2fa8a42ddf2713ced0e9f0c792b78e5540e9fcb6bc97

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:24:42 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-P1
x-amzn-trace-id
Root=1-6408ef0a-78609acf3dbaed823a581a01;Sampled=0
x-amzn-requestid
056d3c67-58e2-4078-b00a-635e15a8a4d3
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
BepJwF9oPHcFRCA=
content-length
2050
x-amz-cf-id
2jOaORbXw503fdj4nwacdoRfl9Nt3lf1t2bC9kHUMpFe2Omhffat0A==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-36.vie50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:24:42 GMT
via
1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-apigw-id
BepJpE6yvHcFhaw=
x-amz-cf-id
Rp2lTvc7B5XB-Q9R28cMScYu6nYyJHKs5J2Hs4CxcaBNbasPf4JcuQ==
x-amz-cf-pop
VIE50-P1
x-amzn-requestid
a73cfb02-1be6-4d80-b096-9c31994c6638
x-cache
Miss from cloudfront
gs
gs.mountain.com/
144 B
733 B
Script
General
Full URL
https://gs.mountain.com/gs
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.12.117.226 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-12-117-226.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
9d71127d52b78e00c65279551775577f3a4a5fbfa0f23eb04880b3ee9f4c91b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:42 GMT
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
istio-envoy
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
cache-control
public, max-age=31536000
x-envoy-upstream-service-time
1
connection
close
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
content-length
144
x-application-context
application:prod:8080
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:42 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
st
px.mountain.com/
5 KB
2 KB
Script
General
Full URL
https://px.mountain.com/st?ga_tracking_id=UA-6177009-1&ga_client_id=2096378197.1678307080&shpt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-6177009-1%22%2C%22ga_client_id%22%3A%222096378197.1678307080%22%2C%22shpt%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%2C%22dcm_cid%22%3A%221678307079.1%22%2C%22dcm_gid%22%3A%221553043268.1678307080%22%2C%22mntnis%22%3A%7B%7D%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=1678307079.1&dcm_gid=1553043268.1678307080&dxver=4.0.0&shaid=32329&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Clanguage%3Den&shoid=%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=1678307081639417&shguid=a9362fc8-92c6-36d0-98bb-566b95c05a29&shgts=1678307082413
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
44.235.191.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-235-191-156.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
eecf213e130b7f9896453de49390928423f60c72b05a66de93ebf0cfad6a317e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:43 GMT
content-encoding
gzip
server
istio-envoy
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
x-envoy-upstream-service-time
16
connection
close
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A42%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:43 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A43%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%224009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je3360&_p=1052230717&cid=2096378197.1678307080&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sid=1678307079&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&_s=2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:24:44 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A44%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225011%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:45 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A45%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:46 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=332c634b-8b94-4c17-8492-5e85be10e0e7&session=e4ffb77a-478b-4178-8423-2f1b023e5904&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A24%3A46%20GMT%22%2C%22timeSpent%22%3A%221009%22%2C%22totalTimeSpent%22%3A%227022%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=8fd0a132-a64d-44df-8243-59e43144822a&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.85.176.46 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-176-46.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:24:47 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

114 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| OneTrustStub function| OptanonWrapper string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData function| ownKeys function| _objectSpread function| _defineProperty function| $ function| attachFailoverAssets function| jQuery object| drupalSettings object| Drupal function| dBlazy function| Bio function| BioMedia object| tabbable function| Popper object| Cookies object| APP object| UTIL object| IPv6 object| punycode object| SecondLevelDomains function| URI function| URITemplate object| lazySizes function| Sifter object| MicroPlugin function| Selectize object| Optanon object| OneTrust object| MktoForms2 function| _toConsumableArray function| _nonIterableSpread function| _unsupportedIterableToArray function| _iterableToArray function| _arrayWithoutHoles function| _arrayLikeToArray function| exposedFiltersUi object| bootstrap object| _wq object| zsForms function| addCaptchaScript object| jQuery1124021304568996643392 object| _utm_data object| utm_data object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| GooglebQhCsO string| GoogleAnalyticsObject function| ga function| doMarketoGASetup object| gaplugins object| gaGlobal object| gaData function| onYouTubeIframeAPIReady function| process6senseData object| _6si string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _linkedin_data_partner_id function| fbq function| _fbq object| techtargetic function| pdst number| sf14gv function| lintrk boolean| _already_called_lintrk string| adroll_sid object| adroll object| __adroll boolean| adroll_optout object| adroll_loaded object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback function| UET function| UET_init function| UET_push object| ueto_bfbe8dd76a object| uetq object| Bizible object| BizTrackingA object| BizA object| _vis_opt_queue object| LC_API object| $jscomp object| fcdsc function| fcdscLoad function| ES6Promise function| gtag function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| adroll_exp_list object| __adroll_consent_data object| MunchkinTracker object| ORIBILI boolean| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country string| dcm_cid undefined| dcm_tid undefined| dcm_gid object| irongate object| mntn

37 Cookies

Domain/Path Name / Value
.info.zscaler.com/ Name: __cf_bm
Value: 2Jgy95xBS_7DbFSHPnLS97oSh6b0SpfRf9RT5goaB9g-1678307079-0-AdIsVXyAbLR50uG+NNwqOX+SJ9uTc2ShcTsEP6P+zTdxIPMG/jJwKlTD8Vd6dbOik6hFF0IR/Nqm/DC8lbQ+IPM=
.www.zscaler.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Wed+Mar+08+2023+20%3A24%3A39+GMT%2B0000+(GMT)&version=6.39.0&isIABGlobal=false&landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0&hosts=H36%3A1%2CH59%3A1%2CH109%3A1%2CH45%3A1%2CH46%3A1%2CH100%3A1%2CH82%3A0%2CH106%3A0%2CH116%3A0%2CH4%3A0%2CH102%3A0%2CH76%3A0%2CH103%3A0%2CH60%3A0%2CH96%3A0%2CH20%3A0%2CH22%3A0%2CH97%3A0%2CH98%3A0%2CH108%3A0%2CH65%3A0%2CH83%3A0%2CH110%3A0%2CH111%3A0%2CH112%3A0%2CH114%3A0%2CH101%3A0%2CH52%3A0%2CH104%3A0%2CH105%3A0%2CH14%3A0%2CH15%3A0%2CH17%3A0%2CH113%3A0%2CH115%3A0&genVendors=
.zscaler.com/ Name: _gcl_au
Value: 1.1.1457898848.1678307080
.zscaler.com/ Name: _gid
Value: GA1.2.1553043268.1678307080
.zscaler.com/ Name: _dc_gtm_UA-6177009-1
Value: 1
.zscaler.com/ Name: _ga_10SPJ4YJL9
Value: GS1.1.1678307079.1.0.1678307079.60.0.0
info.zscaler.com/ Name: BIGipServerabmweb-nginx-app_https
Value: !iVhjC+b6AkcPeCObudb4AMywNyDldeqlcihgz39ZjVpuLt3gYd1dxfurogGADlrQEOwxtjpH7g0zoQ==
.zscaler.com/ Name: _ga
Value: GA1.2.2096378197.1678307080
.zscaler.com/ Name: _gat_UA-6177009-1
Value: 1
.techtarget.com/ Name: __cf_bm
Value: zV45Z59w2JMXMr3Pe_lZqg1Gnett5.Bp1WoAlqtQR04-1678307080-0-AbhcmeygNzrE2Ha6u4+G9jcT+un7w/HPMJBlRNdYJSY86sxOjvBL+P39Eyelrj95LK+MkVo0jxQG8ydAlIkREro=
www.zscaler.com/ Name: __pdst
Value: 93da41b335f84f38a9bce1a1b84bd467
.zscaler.com/ Name: _uetsid
Value: 410b59a0bdef11ed83b1c1d3046f98af
.zscaler.com/ Name: _uetvid
Value: 410b5780bdef11eda38c95baf6b9fb27
.zscaler.com/ Name: _biz_uid
Value: fc50aaa84de840fcedecbe2ae4f22513
.zscaler.com/ Name: _biz_sid
Value: 4e4137
.zscaler.com/ Name: _biz_nA
Value: 1
.zscaler.com/ Name: _biz_pendingA
Value: %5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3Dfc50aaa84de840fcedecbe2ae4f22513%26_biz_s%3D4e4137%26_biz_l%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fonenote-growing-threat-malware-distribution%26_biz_t%3D1678307080448%26_biz_i%3DOneNote%253A%2520A%2520Growing%2520Threat%2520for%2520Malware%2520Distribution%26_biz_n%3D0%26rnd%3D782597%22%5D
.zscaler.com/ Name: _fcdscst
Value: MTY3ODMwNzA4MDQ1Ng==
.zscaler.com/ Name: _fbp
Value: fb.1.1678307080524.1093717080
www.zscaler.com/ Name: ln_or
Value: eyIzMzk2MiI6IjMzOTYyIn0%3D
.zscaler.com/ Name: _mkto_trk
Value: id:306-ZEJ-256&token:_mch-zscaler.com-1678307080557-98784
.doubleclick.net/ Name: IDE
Value: AHWqTUnhSxaEm-QkTlUPQcxjdgzB5NexsTyJUD-Obiue3Uzg_mH6z640qFFY92H1
.linkedin.com/ Name: UserMatchHistory
Value: AQKcRyT_xEt2fgAAAYbC5blZ9WdfkR-QOEVynqumB6WLTk_zrXBguMXD8ZCh49V2QpunvScLk_Rnog
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIc5ulJRVauTgAAAYbC5blZUhtZII5tWUVSlGuf4ITnkbExVG8jkYyLHhjzlg1QcFlIQTX0FudLgACLcb2JSg
.linkedin.com/ Name: bcookie
Value: "v=2&46671d8d-e80e-4145-849b-dd8b46f982e8"
.linkedin.com/ Name: lidc
Value: "b=TGST08:s=T:r=T:a=T:p=T:g=2483:u=1:x=1:i=1678307080:t=1678393480:v=2:sig=AQHC_e78kpkzU_QJwIZ2MUMVKfPwYPIP"
.zscaler.com/ Name: oribili_user_guid
Value: f0646f1d-e5c7-3675-6d2a-fbf113714f57
www.zscaler.com/ Name: _gd_visitor
Value: 332c634b-8b94-4c17-8492-5e85be10e0e7
www.zscaler.com/ Name: _gd_session
Value: e4ffb77a-478b-4178-8423-2f1b023e5904
www.zscaler.com/ Name: _an_uid
Value: 0
.www.linkedin.com/ Name: bscookie
Value: "v=1&202303082024409b2aa647-b177-4c04-81f0-1d8f00fc3c45AQHiRV2UalMlE7gd0aYZSFoDDz8E6S_5"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NzgzMDcwODA7MjswMjE5y1F+aRcgEOVrOJgXXqlVtfkoecCIZDoucnPS09TmpQ==
.6sc.co/ Name: 6suuid
Value: 98054917be8f000008ef0864c5030000b0010004
.mountain.com/ Name: guid
Value: 41c18c23-bdef-11ed-a221-e1d0eee00d19
.zscaler.com/ Name: _fcdscv
Value: eyJDdXN0b21lcklkIjoiNzMxYzMxNmEtYzQ2ZS00YTk0LTgxYTktN2NmYzBlYTBkNTNlIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiIxZGUzMGEzOC05MjhkLTRlN2UtYWY4Ni1jNzk0NzViMGI5NTkifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==
.px.mountain.com/ Name: tt
Value: H4sIAAAAAAAAAKtW8guKNzYyNrKMN7IwtlCyMtBBEjG3NAaLICswNDO3MDYwNwASRhY6SmVKVka1ADvr4btGAAAA
.mountain.com/ Name: rt
Value: "MzIzMjk6MTY3ODMwNzA4Mw=="

4 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://t.sf14g.com/sf14g.js
Message:
Failed to load resource: the server responded with a status of 403 ()
security error URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=49249985280219240term=value
Message:
Refused to connect to 'https://44.212.189.233/is' because it violates the following Content Security Policy directive: "connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251".
javascript error URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=49249985280219240term=value
Message:
Refused to connect to 'https://44.212.189.233/is' because it violates the document's Content Security Policy.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com; img-src 'self' https: data: blob:; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM testmydefenses.com
X-Xss-Protection 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

306-zej-256.mktoresp.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdn.pdst.fm
connect.facebook.net
d.adroll.com
d2i34c80a0ftze.cloudfront.net
dx.mountain.com
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
gw.linkedin.oribi.io
ibc-flow.techtarget.com
info.zscaler.com
ipv6.6sc.co
j.6sc.co
lh4.googleusercontent.com
munchkin.marketo.net
px.ads.linkedin.com
px.mountain.com
px4.ads.linkedin.com
region1.analytics.google.com
s.adroll.com
secure.adnxs.com
snap.licdn.com
st.fullcircleinsights.com
stats.g.doubleclick.net
t.sf14g.com
trk.techtarget.com
us-central1-adaptive-growth.cloudfunctions.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.zscaler.com
104.17.70.206
104.85.176.46
104.87.143.22
13.107.42.14
152.195.15.58
18.66.15.36
192.28.144.124
2001:4860:4802:34::36
2001:4860:4802:36::36
2600:9000:2127:2000:2:53b2:240:93a1
2600:9000:225e:a00:6:9280:1080:93a1
2600:9000:2490:ba00:9:14eb:6280:93a1
2606:4700:4400::ac40:9062
2606:4700::6812:1c4a
2606:4700::6812:c9f
2606:4700::6813:bc61
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:806::2002
2a00:1450:4001:806::2004
2a00:1450:4001:810::2003
2a00:1450:4001:810::200e
2a00:1450:400c:c09::9c
2a00:1450:400d:803::2008
2a00:1450:400d:80a::2001
2a02:26f0:3500:16::215:14a0
2a02:26f0:ab00:39d::1c91
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:d018:cc3:fe04:8902:5bff:76db:b5d5
3.214.188.44
34.111.208.231
34.214.245.73
34.238.149.65
35.244.142.80
37.252.171.85
44.235.191.156
52.12.117.226
0026207a95ec76029445ec7fd6eda7a06dfb1778cb84464e36f661711db17ea4
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
0750e83b0c29c463b422d3d38110eac0790cb2c550817da81476207049af840b
0adad532f06f7ebc4c00a0583967864cfa69363984e8f440c05ff53cd6ed3392
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0e663bc1728001a3d1ab8c19e7dc459cc3487c1e7814bcd3d1704fd38529927a
0f7832c8054c16e592d3697f5612969b692ac94197aa591b5487795f7c928c1b
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
1ae740ebbe1a0c68cdf60b2d5df40126d47e6c69d19bf794b8a99ad5ceb81992
1ea34bd4a6b3dc4f37d57942239fe7c5afb5e3c123e290f99bb840ea2b2a992a
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2aaa0eac6ba23ee39304a3badfb67a930293225d20cd99538e0064186ca3ee91
2de67a71099717228816ba0d42a98621ece6856c97005ab956f749c0bfd8911b
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
359b1185178b99c26c1efb30a1a9b75e0cb5aa0abcf637affbe62c4dfa0ca19f
35ee3c0ae3f5a52f211788bbcd368094fbdfbe1b489245bc8949e68f3bd54d5e
4bceb9f32efde2d668a8d95c0a9ac403bb83e3fd48e8d4b91bda4855910963fc
4df81545b0f6aadb4bcf499cc2afd833e4047b40f4dc5ff9d3bb35ed84abebd9
52aef2e29527ef32fc04e0f34c0e20411e03a575b45f25f939f1932a1069efbf
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58f940a590945336956edbe4a07edb6f55fb69602c24a22face9b35896b2bf2b
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5d23676da3d5b10007f7f675da723f274604cd88397dc25c4721519973994a71
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
69fe3a3cb8e52c9522e1317a41bfda30f19e6c199fb84c66f083cd9e35e46442
6bc6239f7eedfec4190603cddea7e514b8f7d26bac8524dc1fea126321f43d0f
6ecf1827dde90b8cecee9b85e645622b51e69b12b2ba1ae4d484fc0b9ef2f842
799750d012928b7eb93488d34a353144910f18087bfd3a0e1519fc14c15a621b
79e40ce5098ca3d5d3ed476b2b4e156829bdec21fb8c07bab967f6525f5c5677
7cb22bf625a50aae649fa06df4af355caeab6f0078a9aa509f83b989c4a963ea
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
844b63ad71315eec490c93ee1f0dcbb615710619fa376ef4a608f42efb27ca5f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85813f6ca8ca7fc81a8ae31d69ac4254d0b4dda08b70f4fe8f2056fda3a0c78f
8636e97cded227990a8dfe7f4c866491216d08dfef3d8645ee12d1576c301ef6
8d1f4dc8f57f1369b2c6e76000c2aa140c684b60459c7f09f4baa7103d14b8a8
9425e201802508d3508b64c3a5d9e7443d268271ed9536a5fadc2961ec633afa
9581d252706f6236028acf67e89cd0c2f8ec64ff46a416bf384b2fd3876080d4
979fad71a30e04878ea6f208924e89593d93fac949e1ddcdd824e265d840b32e
99b5a6256a9ee7c2640c2669ed517975bfb713b36dc3dde5c55b3c2c85885f4c
9be5ede9e1340002dc27657c572cfba606bacf962e4d4f15b244a44a8748df55
9ca2cd7c4ec81e61384542eee07160860dad9a7afd45ef5dd2d09b5cfacbe316
9d71127d52b78e00c65279551775577f3a4a5fbfa0f23eb04880b3ee9f4c91b7
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253
a8079038523e0b4ee4788120fe71f2132b3fdb347428f1f9dd365fecbb794622
a83018a0ad67600ad05abd4fb02932d92e620f065ea461628d51607b644bd363
ab064f552d9f6c01de22431e5ffa4dec46c5fea8c2ecda8d5cd3b8573863308b
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
b676116353f4fc61b28c4305cd66e29e6425b9718b21ea0341987db6aa0850f4
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
c7cfd5dc386d092ab9afb5af683856ed88121e55e6bf1024333c3151ccc46e36
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
da9a77e15c8cbf2596563d3bc8020cc9e547d2b99976a0b77f5eeadf1c492feb
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
df26e59b0ea17beea7651010590153fdbee9f22a8d12315e8e9c3cc6973fcb22
e022d964d4f870719a7e2fa8a42ddf2713ced0e9f0c792b78e5540e9fcb6bc97
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
e117e172395b5b6cbb254e50f7848ecbbf91c4d612c061fdea14127818518193
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e47550d3a9b75cf85fa47a9f7da13fd2bd3b89dd457fa3c7594da480786f3fbb
eab8ca218eeaea15b474b1be7f747a6908682949737059154f1bd428c45f8a50
ee1bb260c49407f450278f03b23aadf996a27c44935a645c66e4044234badd03
eecf213e130b7f9896453de49390928423f60c72b05a66de93ebf0cfad6a317e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2ca5ac3d9cf4d005d7294562694e44b40efd2c194722721a52743c2f43f1a6
ef401955627aaaedffd337dc3a7c4f9ad56f5dcd31f13833772760cda1aaa437
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fb71a91ef4937bdac04520d7e7b1852bb28635ae850934d440360ccc8142c1a4
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe40bb752bab0a83fce103714fcd294ebc51314978fd77c81fe1842d1452df80