URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Submission: On May 16 via api from IN — Scanned from DE

Summary

This website contacted 40 IPs in 5 countries across 31 domains to perform 133 HTTP transactions. The main IP is 2a02:e980:107::cf, located in United States and belongs to INCAPSULA, US. The main domain is www.proofpoint.com. The Cisco Umbrella rank of the primary domain is 196007.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on March 26th 2024. Valid for: a year.
This is the only time www.proofpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
44 2a02:e980:107... 19551 (INCAPSULA)
4 2a00:1450:400... 15169 (GOOGLE)
1 3.160.150.46 16509 (AMAZON-02)
2 34.96.102.137 396982 (GOOGLE-CL...)
3 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 142.250.186.162 15169 (GOOGLE)
2 2606:4700:440... 13335 (CLOUDFLAR...)
3 104.102.141.31 16625 (AKAMAI-AS)
7 104.16.92.80 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:205... 16509 (AMAZON-02)
1 35.156.113.21 16509 (AMAZON-02)
8 2.19.176.179 20940 (AKAMAI-ASN1)
4 2a00:1450:400... 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
5 2606:4700:440... 13335 (CLOUDFLAR...)
1 18.245.86.87 16509 (AMAZON-02)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 2606:4700:440... 13335 (CLOUDFLAR...)
4 35.157.234.167 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 2 37.252.171.53 29990 (ASN-APPNEX)
1 2600:9000:206... 16509 (AMAZON-02)
2 4 142.250.184.198 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
2 34.111.208.231 396982 (GOOGLE-CL...)
1 2a03:2880:f17... 32934 (FACEBOOK)
1 192.28.144.124 15224 (OMNITURE)
4 2600:9000:215... 16509 (AMAZON-02)
1 104.16.95.80 13335 (CLOUDFLAR...)
2 18.245.86.77 16509 (AMAZON-02)
1 2a02:26f0:210... 20940 (AKAMAI-ASN1)
3 172.64.150.44 13335 (CLOUDFLAR...)
2 13.248.142.121 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
133 40
Apex Domain
Subdomains
Transfer
44 proofpoint.com
www.proofpoint.com — Cisco Umbrella Rank: 196007
1 MB
9 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5787
c.6sc.co — Cisco Umbrella Rank: 8716
ipv6.6sc.co — Cisco Umbrella Rank: 5928
b.6sc.co — Cisco Umbrella Rank: 3876
20 KB
8 marketo.com
app-abj.marketo.com — Cisco Umbrella Rank: 450370
74 KB
7 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 89
10031399.fls.doubleclick.net — Cisco Umbrella Rank: 846962
googleads.g.doubleclick.net — Cisco Umbrella Rank: 35
4788165.fls.doubleclick.net — Cisco Umbrella Rank: 408734
2 KB
7 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 4480
buttons-config.sharethis.com — Cisco Umbrella Rank: 5194
l.sharethis.com — Cisco Umbrella Rank: 4832
platform-cdn.sharethis.com — Cisco Umbrella Rank: 9723
51 KB
5 g2crowd.com
tracking.g2crowd.com — Cisco Umbrella Rank: 7754
3 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 338
px4.ads.linkedin.com — Cisco Umbrella Rank: 6419
2 KB
4 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2777
9 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 32
21 KB
4 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3095
www.google.com — Cisco Umbrella Rank: 2
391 B
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
379 KB
3 zi-scripts.com
js.zi-scripts.com — Cisco Umbrella Rank: 6903
4 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 26104
ibc-flow.techtarget.com — Cisco Umbrella Rank: 23444
2 KB
3 driftt.com
js.driftt.com — Cisco Umbrella Rank: 5864
62 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 345
14 KB
3 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3868
6 KB
2 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 4715
2 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9185
722 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 482
2 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 183
72 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33
3 KB
2 geoip-js.com
geoip-js.com — Cisco Umbrella Rank: 16598
2 KB
2 google.de
www.google.de — Cisco Umbrella Rank: 7810
126 B
2 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2757
3 KB
1 mktoresp.com
309-rhv-619.mktoresp.com — Cisco Umbrella Rank: 403239
318 B
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 101
273 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 17338
282 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 15638
279 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 803
17 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 126
20 KB
0 mutinycdn.com Failed
client-registry.mutinycdn.com Failed
133 31
Domain Requested by
44 www.proofpoint.com www.proofpoint.com
www.googletagmanager.com
8 app-abj.marketo.com www.proofpoint.com
app-abj.marketo.com
6 b.6sc.co www.proofpoint.com
5 tracking.g2crowd.com www.proofpoint.com
4 platform-cdn.sharethis.com www.proofpoint.com
4 tags.srv.stackadapt.com www.proofpoint.com
tags.srv.stackadapt.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
4 www.googletagmanager.com www.proofpoint.com
www.googletagmanager.com
3 js.zi-scripts.com www.proofpoint.com
js.zi-scripts.com
3 px.ads.linkedin.com 2 redirects snap.licdn.com
3 js.driftt.com www.proofpoint.com
js.driftt.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.proofpoint.com
3 munchkin.marketo.net www.proofpoint.com
munchkin.marketo.net
3 region1.analytics.google.com www.googletagmanager.com
2 ws.zoominfo.com js.zi-scripts.com
2 epsilon.6sense.com j.6sc.co
2 4788165.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 ibc-flow.techtarget.com trk.techtarget.com
2 10031399.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 secure.adnxs.com 2 redirects
2 connect.facebook.net www.proofpoint.com
connect.facebook.net
2 fonts.googleapis.com www.proofpoint.com
2 geoip-js.com www.proofpoint.com
geoip-js.com
2 www.google.de www.proofpoint.com
2 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 dev.visualwebsiteoptimizer.com www.proofpoint.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 309-rhv-619.mktoresp.com munchkin.marketo.net
1 www.facebook.com www.proofpoint.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 px4.ads.linkedin.com www.proofpoint.com
1 www.google.com www.proofpoint.com
1 attr.ml-api.io www.proofpoint.com
1 s.ml-attr.com 1 redirects
1 trk.techtarget.com www.proofpoint.com
1 snap.licdn.com www.proofpoint.com
1 j.6sc.co www.proofpoint.com
1 l.sharethis.com platform-api.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 www.googleadservices.com www.proofpoint.com
1 platform-api.sharethis.com www.proofpoint.com
0 client-registry.mutinycdn.com Failed www.googletagmanager.com
133 43
Subject Issuer Validity Valid
proofpoint.com
Sectigo RSA Organization Validation Secure Server CA
2024-03-26 -
2025-03-26
a year crt.sh
*.google-analytics.com
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
sharethis.com
Amazon RSA 2048 M03
2024-04-19 -
2025-05-17
a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2
2023-07-06 -
2024-07-06
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2024-04-16 -
2024-07-09
3 months crt.sh
*.google.de
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
*.googleadservices.com
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
geoip-js.com
GTS CA 1P5
2024-04-16 -
2024-07-15
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-12-08 -
2024-12-11
a year crt.sh
app-abj.marketo.com
Cloudflare Inc ECC CA-3
2024-03-05 -
2024-12-31
10 months crt.sh
upload.video.google.com
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
6sc.co
R3
2024-04-09 -
2024-07-08
3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 02
2024-05-01 -
2024-06-27
2 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-24 -
2024-07-23
a year crt.sh
drift.com
Amazon RSA 2048 M02
2023-08-15 -
2024-09-11
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2024-02-23 -
2024-05-23
3 months crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M02
2023-09-09 -
2024-10-07
a year crt.sh
*.doubleclick.net
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
*.google.com
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-01-30 -
2024-07-30
6 months crt.sh
ibc-flow.techtarget.com
GTS CA 1D4
2024-05-06 -
2024-08-04
3 months crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-09-07 -
2024-10-07
a year crt.sh
zi-scripts.com
GTS CA 1P5
2024-03-29 -
2024-06-27
3 months crt.sh
*.6sense.com
Amazon RSA 2048 M03
2024-03-31 -
2025-04-29
a year crt.sh
zoominfo.com
E1
2024-04-19 -
2024-07-18
3 months crt.sh

This page contains 6 frames:

Primary Page: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Frame ID: 8090B2058E24BA8D71A5C6410ABA4DC7
Requests: 125 HTTP requests in this frame

Frame: https://10031399.fls.doubleclick.net/activityi;dc_pre=CIaz1q3ZkYYDFYxHHgIdNQANYw;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering;u4=undefined;u5=undefined;u6=undefined;u7=undefined;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe45f0z876619393za201;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering
Frame ID: 0FB841C60CBE7B5C6D6F3A2CE2D2A02A
Requests: 1 HTTP requests in this frame

Frame: https://4788165.fls.doubleclick.net/activityi;dc_pre=COCmjq7ZkYYDFZtFHgIdZUwOkg;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193
Frame ID: 203184E249B58212D2A7CF9DFABE0DF2
Requests: 1 HTTP requests in this frame

Frame: https://app-abj.marketo.com/index.php/form/XDFrame
Frame ID: D2D268983050D5E691D6FFBFACF59BD9
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=5dfsgn7m2kst&eId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=dd0415eb-0a94-46ed-8d2b-3a97994e50fb&sessionStarted=1715846244.017&campaignRefreshToken=d8cce813-8572-4699-9e31-ba2f24fda4bf&hideController=false&pageLoadStartTime=1715846239812&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering
Frame ID: 537C7B6B0F29FA6AC1573015C43ADE02
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1715846239812
Frame ID: 96EF19B96C36A27DF4FC624CFE790A1E
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering  | Proofpoint US

Detected technologies

Overall confidence: 75%
Detected patterns

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

Page Statistics

133
Requests

96 %
HTTPS

54 %
IPv6

31
Domains

43
Subdomains

40
IPs

5
Countries

2244 kB
Transfer

5768 kB
Size

45
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 73
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=6131264085712994859
Request Chain 78
  • https://10031399.fls.doubleclick.net/activityi;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering;u4=undefined;u5=undefined;u6=undefined;u7=undefined;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe45f0z876619393za201;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering HTTP 302
  • https://10031399.fls.doubleclick.net/activityi;dc_pre=CIaz1q3ZkYYDFYxHHgIdNQANYw;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering;u4=undefined;u5=undefined;u6=undefined;u7=undefined;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe45f0z876619393za201;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering
Request Chain 81
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&cookiesTest=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&cookiesTest=true&e_ipv6=AQI25-GzudpUdQAAAY-AZ90_Z5EZwrVy1Y0tmXL01WFObT8ZlHSE2gjtxnuvoGOuaLs14mxuT3xDFS_mnC_CCi8Qj-Kpzw
Request Chain 100
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193 HTTP 302
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=COCmjq7ZkYYDFZtFHgIdZUwOkg;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193

133 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request social-engineering-dmarc-abuse-ta427s-art-information-gathering
www.proofpoint.com/us/blog/threat-insight/
75 KB
21 KB
Document
General
Full URL
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
2fcc89a225150f8d1c9c173c1eeb64f41c02c90932fd111203ac65ca5e1594f1
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
max-age=29913, public
Content-Encoding
gzip
Content-Length
18356
Content-Security-Policy
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
Content-Type
text/html; charset=UTF-8
Date
Thu, 16 May 2024 07:57:19 GMT
Etag
"1715767315-gzip"
Expires
Thu, 16 May 2024 16:15:52 GMT
Feature-Policy
geolocation 'self'
Last-Modified
Wed, 15 May 2024 10:01:55 GMT
Referrer-Policy
origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-CDN
Imperva
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Iinfo
7-42969490-42966620 2CNN RT(1715846238569 348) q(0 0 0 3) r(0 0)
X-Imperva-Purge-Tags
fk0h,2171,rsmc,0plh,r6o8,li2r,ebfb,unor,vunp,0pnq,jamf,p7tt,khv0,8qo7,eken,6bqn,bvs8,4l7m,ohju,h17a,b72s,4b6g,5ju5,d8uh,29hq,8573,ur8f,etfr,sesm,efl8,if90,p38p,7nqj,l5kc,eqb1,9lcq,fj6k,shcs,l2u0,5cr3,80b8,mu60,us5v,vkkb,v2on,prna,j81r,233k
X-Permitted-Cross-Domain-Policies
none
js
www.googletagmanager.com/gtag/
320 KB
104 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e9f9158aa766d8d7fb6bfd1d0bf9ab1f95cfe61bea39e105028d569fb4234295
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:19 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
106160
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 16 May 2024 07:57:19 GMT
proofpoint.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
18 KB
18 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/proofpoint.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"01c16c31"
X-Iinfo
5-34955499-0 0CNN RT(1715846238824 391) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308241, public
x-incap-sess-cookie-hdr
iy0rShPWx04ESrmDFfj4EF+8RWYAAAAAP56Uv8FNC//u8BGa2ojxJw==
Content-Length
18296
Expires
Sun, 19 May 2024 21:34:40 GMT
RobotoCondensed-Regular-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Regular-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"39ed386e"
Content-Type
application/font-woff
X-Iinfo
11-42971889-0 0CNN RT(1715846239488 277) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=167010, public
x-incap-sess-cookie-hdr
JkwnMrwFuQoESrmDFfj4EF+8RWYAAAAAa5ZP4i2l7mGnM8qhso3r/g==
Content-Length
20951
Expires
Sat, 18 May 2024 06:20:49 GMT
fjalla-one-v7-latin-regular.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
20 KB
20 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"3a88d25f"
Content-Type
application/font-woff
X-Iinfo
11-42971890-0 0CNN RT(1715846239488 280) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=293956, public
x-incap-sess-cookie-hdr
gM3bcvtt1B0ESrmDFfj4EF+8RWYAAAAAZQko+/Ofrby+kaypDUMHIw==
Content-Length
19954
Expires
Sun, 19 May 2024 17:36:35 GMT
fjalla-one-v7-latin-regular.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
16 KB
17 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"80852160"
X-Iinfo
6-37942376-0 0CNN RT(1715846239488 289) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308241, public
x-incap-sess-cookie-hdr
YgQlDAviJCYESrmDFfj4EF+8RWYAAAAAsbi7gRT5wPCc52BwkC5vqw==
Content-Length
16540
Expires
Sun, 19 May 2024 21:34:40 GMT
RobotoCondensed-Bold-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Bold-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"8df65834"
Content-Type
application/font-woff
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 304) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=293956, public
x-incap-sess-cookie-hdr
zVdhW+u7CkcESrmDFfj4EF+8RWYAAAAAzdPXvlXsXvn/Y9JPdUe2QA==
Content-Length
21304
Expires
Sun, 19 May 2024 17:36:35 GMT
Swiss.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
32 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4b274cd219e6f9e664781b8997843f0881f8911ffbc922349ec4c7b35d50ed78
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"f6fb6a17"
X-Iinfo
5-34955499-0 0CNN RT(1715846238824 950) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308241, public
x-incap-sess-cookie-hdr
SmJyRsUG71sESrmDFfj4EF+8RWYAAAAAiW5RJpVi4HkAWOHxf1oYxA==
Content-Length
31932
Expires
Sun, 19 May 2024 21:34:40 GMT
Swiss.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
32 KB
33 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0b291571122aec79a4f86f9e799ff7707ee3dc914413f425feede8259612ecc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"715d0b99"
Content-Type
application/font-woff
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 1480) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=293955, public
x-incap-sess-cookie-hdr
8ZxbfyTukVcESrmDFfj4EGC8RWYAAAAAMaXpAABFypCxwlvO4hYq2w==
Content-Length
32803
Expires
Sun, 19 May 2024 17:36:35 GMT
Swiss-Italic.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
32 KB
33 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Italic.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
72a15930d7a4561b6af10b65f0e28f3956ef3001404e6fa5ed15ae795567befc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"803b9ae6"
X-Iinfo
5-34955499-0 0CNN RT(1715846238824 1230) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
x-incap-sess-cookie-hdr
CSSVeWXXdUYESrmDFfj4EGC8RWYAAAAA7AIpmViCG8RPvYAkMJ2pQQ==
Content-Length
32892
Expires
Sun, 19 May 2024 21:34:40 GMT
Swiss-Italic.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
33 KB
34 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Italic.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
737324c6a9ca813b87b9a4a164306097cbcb07bc96b74db797f9cd8cee9fc31a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"a22e4f0f"
Content-Type
application/font-woff
X-Iinfo
11-42971889-0 0CNN RT(1715846239488 829) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=293954, public
x-incap-sess-cookie-hdr
ZsFKFoXrtC8ESrmDFfj4EGC8RWYAAAAAb9w+uHntTuaskldHny4qKA==
Content-Length
33778
Expires
Sun, 19 May 2024 17:36:34 GMT
Swiss-Medium.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
32 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Medium.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e0d9ca9316294d8c98704da12c55856a2bc837adf42106bb0b7ab89f77115540
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"9545894f"
X-Iinfo
11-42971890-0 0CNN RT(1715846239488 836) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
x-incap-sess-cookie-hdr
XJyfPKs6IgwESrmDFfj4EGC8RWYAAAAAG0ceJrOw9inLxjO039/T7Q==
Content-Length
31844
Expires
Sun, 19 May 2024 21:34:40 GMT
Swiss-Medium.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
32 KB
32 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Medium.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
a54fee5912de81021ec64a51dc08b3781b38be49e178936b134ff777e23185ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"a8e8cd5d"
Content-Type
application/font-woff
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 1756) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=167010, public
x-incap-sess-cookie-hdr
f6AncTI4f3gESrmDFfj4EGC8RWYAAAAArFSTVLUTSy5JDfRRGeeBTw==
Content-Length
32534
Expires
Sat, 18 May 2024 06:20:50 GMT
Swiss-Bold.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
31 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Bold.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0660976790bb5eed64d9617a793a7fcd80b6180f6793c9a68162d0ea12114f2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"013bb7f6"
X-Iinfo
6-37942376-0 0CNN RT(1715846239488 840) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=302923, public
x-incap-sess-cookie-hdr
fWvbOuROPFcESrmDFfj4EGC8RWYAAAAAn+dyUDkoHiZSJ8n9MvDLkw==
Content-Length
31304
Expires
Sun, 19 May 2024 20:06:03 GMT
Swiss-Bold.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
32 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Bold.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d756aa94bf52a495078ecadd896d7deec037433e2df5609d7bd0d5388f084997
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"3ffdb236"
Content-Type
application/font-woff
X-Iinfo
5-34955499-0 0CNN RT(1715846238824 1511) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=167010, public
x-incap-sess-cookie-hdr
m+uuQnBZT1UESrmDFfj4EGC8RWYAAAAAbJr+4ClXuGGpSqt0RtLFgg==
Content-Length
31716
Expires
Sat, 18 May 2024 06:20:50 GMT
css_SzsfcKm17EaxTSftk5pG4vhuvmtTMk2JTGHvDvyHSOU.css
www.proofpoint.com/sites/default/files/css/
25 KB
5 KB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_SzsfcKm17EaxTSftk5pG4vhuvmtTMk2JTGHvDvyHSOU.css?delta=0&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
88dfd6fc2bf5814e1fd826b25417ab4e0f11354c5adf2fa49dad6d97e444ebb6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:05:10 GMT
X-CDN
Imperva
Content-Type
text/css
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 909) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=169850, public
Content-Length
4439
Expires
Sat, 18 May 2024 07:08:09 GMT
css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css
www.proofpoint.com/sites/default/files/css/
250 KB
31 KB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
a648ce121471a1df44d51ddf4ef7e63c730ca77c1c59b0002e01004c4473f3bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:19 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Tue, 14 May 2024 23:13:16 GMT
X-CDN
Imperva
Content-Type
text/css
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 1187) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1093186, public
Content-Length
31461
Expires
Tue, 28 May 2024 23:37:05 GMT
js_Wi8RdyzDF-uwGcwq9eMv1Giiu7RfMo7nYneG5kg6rd4.js
www.proofpoint.com/sites/default/files/js/
2 KB
1 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_Wi8RdyzDF-uwGcwq9eMv1Giiu7RfMo7nYneG5kg6rd4.js?scope=header&delta=0&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
1519ceaa67bcd32243176aa59028ac713011d3fdb6e9ef4dffa70cce31ae8cf9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:04:50 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 862) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=169849, public
Content-Length
752
Expires
Sat, 18 May 2024 07:08:09 GMT
sharethis.js
platform-api.sharethis.com/js/
206 KB
46 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.160.150.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-160-150-46.fra60.r.cloudfront.net
Software
/
Resource Hash
98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:55:43 GMT
content-encoding
gzip
via
1.1 444bee00bd8f759506e806be3c13fa6c.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA60-P7
age
96
etag
W/"336d0-g/6wprihOkYe7HpMswOVDodT6lU"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-cache
Hit from cloudfront
x-amz-cf-id
_-ZtfKgjAia95esAHFuUvF0AvU-pv4gU0JczbSk7TPXqynNKRh3Lhw==
gtm.js
www.googletagmanager.com/
431 KB
121 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
55c61b6a15a6e2094e6e4a32b201ca57af2b03b99d1c812c0fef04bae3dbb9f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
123491
x-xss-protection
0
last-modified
Thu, 16 May 2024 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 16 May 2024 07:57:21 GMT
j.php
dev.visualwebsiteoptimizer.com/
7 KB
3 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=767242&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&f=1&vn=1.3
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
49d8c0046653590d7a41df2d1b8c1a7cbef5cb5fac7efdeceeac710ce6237078

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:19 GMT
content-encoding
gzip
via
1.1 google
server
gfra1
etag
W/"1715779498_EA"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0, no-cache, must-revalidate
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
v.gif
dev.visualwebsiteoptimizer.com/
35 B
152 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=767242&d=proofpoint.com&u=D81E81C0A209E2CB8C8A2CE49D127CA66&h=f5a8cf16e2f47e260681c6118debf8f5&t=false
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv1c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv1c
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=43200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
collect
region1.analytics.google.com/g/
0
257 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-B1V8SZE3GL&gtm=45je45f0v890103917za200&_p=1715846239564&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1332484325.1715846240&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1715846239&sct=1&seg=0&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&dt=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1078
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:19 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
248 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-B1V8SZE3GL&cid=1332484325.1715846240&gtm=45je45f0v890103917za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:19 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-B1V8SZE3GL&cid=1332484325.1715846240&gtm=45je45f0v890103917za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=497936965
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
conversion.js
www.googleadservices.com/pagead/
53 KB
20 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
7722334fb6c6245e16012b8507cca1836cd7dc3f6e7cb1c8ba11f30f2fe09b24
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:19 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19953
x-xss-protection
0
server
cafe
etag
16300629805421521552
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 16 May 2024 07:57:19 GMT
js_2415u1Hepa_5UfUOXUULwOJ7q-EWASC7sHnIY2UXgT0.js
www.proofpoint.com/sites/default/files/js/
150 KB
52 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_2415u1Hepa_5UfUOXUULwOJ7q-EWASC7sHnIY2UXgT0.js?scope=footer&delta=0&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
daad388c25a3e461319286cb929ca60c6d9f5678605d604e8817e10e892327b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Tue, 07 May 2024 22:30:31 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
11-42971889-0 0CNN RT(1715846239488 1119) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=485118, public
Content-Length
52415
Expires
Tue, 21 May 2024 22:42:38 GMT
geoip2.js
geoip-js.com/js/apis/geoip2/v2.1/
3 KB
2 KB
Script
General
Full URL
https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:216e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 16 May 2024 07:56:16 GMT
server
cloudflare
age
63
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
8849d0f78fca5c20-FRA
expires
Thu, 16 May 2024 11:57:19 GMT
js_DA7GHFg6Iz1O22c58zPl-nNTEwx5y7RuyKjesK1mXJI.js
www.proofpoint.com/sites/default/files/js/
5 KB
2 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_DA7GHFg6Iz1O22c58zPl-nNTEwx5y7RuyKjesK1mXJI.js?scope=footer&delta=2&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
64ac610477f4c2a19d7ade073fef3eccaa7db99efa5ff86733fb44c33c55226a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:04:50 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 2046) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=319393, public
Content-Length
1661
Expires
Mon, 20 May 2024 00:40:33 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.141.31 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-141-31.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
js_Q_hAq3KoriT4uxdUnA3XDouviRgbwswFyj5MCBnzVHU.js
www.proofpoint.com/sites/default/files/js/
48 KB
14 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_Q_hAq3KoriT4uxdUnA3XDouviRgbwswFyj5MCBnzVHU.js?scope=footer&delta=4&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
480dfc4f346103ef7f50a60ef2462bc7ef967a06ee6ed20c6dcb50a6ef48d66e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:04:50 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 1175) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=446744, public
Content-Length
13427
Expires
Tue, 21 May 2024 12:03:04 GMT
app.js
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/js/
2 MB
519 KB
Script
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/js/app.js?q=Xau4jUUfTOQ&v=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
5739cc9f6968228ab43635534881c198f400f265a29a8fe9519f607ac5b4f214
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Tue, 14 May 2024 23:09:16 GMT
X-CDN
Imperva
Content-Type
application/javascript
X-Iinfo
5-34955499-0 0CNN RT(1715846238824 1837) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1106203, public
Content-Length
530940
Expires
Wed, 29 May 2024 03:14:03 GMT
js_2LYNA9Zu5KE51oXU7U2qX9zbS5cCqO7wzxelxAEWhjk.js
www.proofpoint.com/sites/default/files/js/
373 B
729 B
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_2LYNA9Zu5KE51oXU7U2qX9zbS5cCqO7wzxelxAEWhjk.js?scope=footer&delta=6&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
8fd5dcb3427fad9f1304d5a1eafd0f9db5aafdf9eabe50bb1e5c2a16fc521efe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:04:50 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
6-37942376-0 0CNN RT(1715846239488 1179) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=170666, public
Content-Length
277
Expires
Sat, 18 May 2024 07:21:46 GMT
forms2.min.js
app-abj.marketo.com/js/forms2/js/
199 KB
67 KB
Script
General
Full URL
https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63113904
last-modified
Tue, 23 Apr 2024 04:13:58 GMT
server
cloudflare
cf-cache-status
HIT
age
521
etag
"121c6b-31af8-616bbc873ed80"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
8849d0ff1dc31da6-FRA
expires
Thu, 16 May 2024 11:57:21 GMT
css
fonts.googleapis.com/
12 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700|Open+Sans+Condensed:300
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e2a193fa1b1801dcdddf024a250b04b496f5e36e4324a8de73948e6421ff5865
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 16 May 2024 07:57:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 16 May 2024 07:57:20 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 16 May 2024 07:57:20 GMT
css2
fonts.googleapis.com/
28 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7e7fd9f1e6fd2387dc2a5bb83cb72a1c44206347ad8ffde69bcab829cf88b1ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 16 May 2024 07:57:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 16 May 2024 07:39:12 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 16 May 2024 07:57:20 GMT
6543fd1a2398960013d900a7.js
buttons-config.sharethis.com/js/
745 B
1 KB
Script
General
Full URL
https://buttons-config.sharethis.com/js/6543fd1a2398960013d900a7.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:ac00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9c1b1066c42f920ce30aee11e0645fc48f66f13f828e31865b34abe54d6dd4e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:22 GMT
via
1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 17 Nov 2023 07:10:02 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
x-amz-server-side-encryption
AES256
etag
"923a352055e8a91048dec7ed5b809c72"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
745
x-amz-cf-id
A1hyFhH8hzT6s48C6VZ87uwD9TS9nVKBf1cm1E7GeTnPfpNQfsyyIw==
pview
l.sharethis.com/
0
405 B
XHR
General
Full URL
https://l.sharethis.com/pview?event=pview&hostname=www.proofpoint.com&location=%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&product=inline-share-buttons&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&cms=unknown&publisher=6543fd1a2398960013d900a7&sop=true&version=st_sop.js&lang=en&description=Key%20takeaways%E2%80%AF%C2%A0%20TA427%20regularly%20engages%20in%20benign%20conversation%20starter%20campaigns%20to%20establish%20contact%20with%20targets%20for%20long-term%20exchanges%20of%20information%20on%20topics%20of%20strategic%20importance%20to%20the%20No...&ua=%22Google%20Chrome%22%3Bv%3D%22124%22%2C%20%22Not%3AA-Brand%22%3Bv%3D%228%22%2C%20%22Chromium%22%3Bv%3D%22124%22&ua_mobile=false&ua_platform=Win32&ua_full_version_list=%22Chromium%22%3Bv%3D%22124.0.6367.201%22%2C%20%22Google%20Chrome%22%3Bv%3D%22124.0.6367.201%22%2C%20%22Not-A.Brand%22%3Bv%3D%2299.0.0.0%22&ua_platform_version=10.0.0&uuid=0b7e13b8-6fdf-4a9c-b1bb-55987dec1a98
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.113.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-113-21.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
https://www.proofpoint.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
munchkin.js
munchkin.marketo.net/
1 KB
0
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.141.31 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-141-31.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Accept-Ranges
bytes
Content-Length
729
globe.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
808 B
796 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/globe.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
2b72026eaaae017cb9535ad20f82d00bc0ce390c76fbf5268e4708f9bf5e9bf8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"e4edf726"
Content-Type
image/svg+xml
X-Iinfo
11-42971890-0 0CNN RT(1715846239488 1203) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=302923, public
Content-Length
327
Expires
Sun, 19 May 2024 20:06:03 GMT
search.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
514 B
766 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/search.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
3d827d05f0c1502d3b245e544611619ddb4d0eec78f55940594ae531e4f62cfc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"9fc0adb6"
Content-Type
image/svg+xml
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 1465) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=312686, public
Content-Length
298
Expires
Sun, 19 May 2024 22:48:46 GMT
user.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
779 B
835 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/user.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
55bda2f21018d051f95b3aebea318bd719370a3a870245f92dd9c3e7d6348a59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"63f6cd8c"
Content-Type
image/svg+xml
X-Iinfo
11-42971889-0 0CNN RT(1715846239488 1409) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=312686, public
Content-Length
366
Expires
Sun, 19 May 2024 22:48:46 GMT
logo-black.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
5 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/logo-black.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6450691706460a0ed12542c899ec8108a2856abefd157b9ef298661ebb5ab506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"617fefc4"
Content-Type
image/svg+xml
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 2330) q(0 -1 -1 -1) r(1 -1)
Cache-Control
max-age=308240, public
Content-Length
1876
Expires
Sun, 19 May 2024 21:34:40 GMT
global-elements-arrow-blue.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
584 B
790 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/global-elements-arrow-blue.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
bd5584dd3ce86c6fc33cf17cc82ee828026eaa7c7b7ac0699db83efade55f06b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"529df945"
Content-Type
image/svg+xml
X-Iinfo
6-37942376-0 0CNN RT(1715846239488 1821) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308239, public
Content-Length
322
Expires
Sun, 19 May 2024 21:34:40 GMT
x.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
364 B
696 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/x.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
751b1a09760d9c50041b5f070968f1ae898dfb4f6f89b86d0bfa6526d0dc89ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"e9257f17"
Content-Type
image/svg+xml
X-Iinfo
11-42971889-0 0CNN RT(1715846239488 1687) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308239, public
Content-Length
227
Expires
Sun, 19 May 2024 21:34:40 GMT
block-subscribe-button-addthis.webp
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
2 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/block-subscribe-button-addthis.webp
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
5f3083b731588016304b0ac105b66985b8ffc9d2c7a2e627f0435da5e86a4648
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"81ec458f"
X-Iinfo
11-42971890-0 0CNN RT(1715846239488 1483) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=495689, public
Content-Length
1656
Expires
Wed, 22 May 2024 01:38:49 GMT
content-pager-arrow.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
618 B
798 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/content-pager-arrow.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
ece2d0c67a92dd2e9092416cd1c60151504e8f7eed717af3b152420c3684a3f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"4a312a01"
Content-Type
image/svg+xml
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 1744) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
Content-Length
330
Expires
Sun, 19 May 2024 21:34:41 GMT
marketo-form-spinner.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
3 KB
877 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/marketo-form-spinner.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
5680e67bec883a7cc47635705afdaa0d28ad681a1bec515983784fe6c002356b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Tue, 09 Apr 2024 22:57:55 GMT
X-CDN
Imperva
Etag
"d85f1d02"
Content-Type
image/svg+xml
X-Iinfo
11-42971890-0 0CNN RT(1715846239488 1762) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
Content-Length
408
Expires
Sun, 19 May 2024 21:34:41 GMT
footer-logo-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
5 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/footer-logo-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4ae79f6079013e0b6e62b871e558a573823eed1be52852634e13d3bee5663380
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"c5d52ce3"
Content-Type
image/svg+xml
X-Iinfo
11-42971889-0 0CNN RT(1715846239488 2320) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
Content-Length
1851
Expires
Sun, 19 May 2024 21:34:41 GMT
icon-facebook-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
416 B
746 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-facebook-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
a7de65ae8dbd3767d98f475502d97732a81ceecbc6f1b2f52f03e457207753d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"4e9616dc"
Content-Type
image/svg+xml
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 2886) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
Content-Length
278
Expires
Sun, 19 May 2024 21:34:41 GMT
icon-x-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
425 B
761 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-x-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d790432627c2bcb0358551fe8035b2a90757cd31a6eccf189f2f0c809e89ad80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"42cf034a"
Content-Type
image/svg+xml
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 2022) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=302922, public
Content-Length
293
Expires
Sun, 19 May 2024 20:06:03 GMT
icon-linkedin-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
930 B
864 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-linkedin-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
aa44e3c804607a8a17c2e9597537350b4e425c1708a1c7c6fc50a28dba1fd488
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"741a7867"
Content-Type
image/svg+xml
X-Iinfo
11-42971890-0 0CNN RT(1715846239488 2051) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
Content-Length
395
Expires
Sun, 19 May 2024 21:34:41 GMT
icon-youtube-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
997 B
904 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-youtube-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6312cd49d1d0b91d2aa283cba2ad0365fc697b3e7fc5b34f6e749ba646b4ec31
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"c7cf9483"
Content-Type
image/svg+xml
X-Iinfo
6-37942376-0 0CNN RT(1715846239488 2098) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
Content-Length
436
Expires
Sun, 19 May 2024 21:34:41 GMT
Swiss-Medium.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
0
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Medium.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
280f323a35d8fd5cb49e44ea4d9847641b60beb3a21ea34b9116f0c7cfe85003
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/sites/default/files/css/css_dCSDFQkfgp71uKUlziySJ29B-kDWokx-w7WaiXRw6Ug.css?delta=1&language=en&theme=particle&include=eJxdj0GOwzAIRS8UyxrNZm5TgcvYVmywAFfq7Zt047QbJP7_PGCMW_3549iA84RM4U5OyUW3MW4ddCeX2Censlc-NSPQVOL02uzsvVCn6CINQTd7mlOPCEbbAPWaGsUkSpcoIANi5bwS_yJOGh6_7w0FlOK7eqm2UtgkX6nsxB7GcbV-hNIebKIlrUgBp7vwxVeCe9LZ8Yu8ZpZ-wZzYZZQDchzM8FhaboLQArXjS3Z7AWf-hXw
Origin
https://www.proofpoint.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:20 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 04 May 2024 02:00:33 GMT
X-CDN
Imperva
Etag
"9545894f"
X-Iinfo
11-42971890-0 0CNN RT(1715846239488 836) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=308240, public
x-incap-sess-cookie-hdr
XJyfPKs6IgwESrmDFfj4EGC8RWYAAAAAG0ceJrOw9inLxjO039/T7Q==
Content-Length
31844
Expires
Sun, 19 May 2024 21:34:40 GMT
pfpt-cs-banner-defense-contractor.png.webp
www.proofpoint.com/sites/default/files/styles/image_1920_750/public/cs-banners/
18 KB
19 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/styles/image_1920_750/public/cs-banners/pfpt-cs-banner-defense-contractor.png.webp?itok=zCkcL86G
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
c085f071c91cba3d92b143fa274473c70d13d5ce516150ae794d3ffba17791b5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 11 Apr 2024 17:07:56 GMT
X-CDN
Imperva
Content-Type
image/png
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 2606) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=434596, public
Content-Length
18818
Expires
Tue, 21 May 2024 08:40:37 GMT
f1_0.png
www.proofpoint.com/sites/default/files/inline-images/
65 KB
65 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/f1_0.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4d6d961566d4d8147e52004898f04998d55bf475203c8aff3c9de126926d8c8c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 11 Apr 2024 17:01:13 GMT
X-CDN
Imperva
Etag
"545f80a0"
Content-Type
image/png
X-Iinfo
7-42969490-0 0CNN RT(1715846238569 3161) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=172961, public
Content-Length
66584
Expires
Sat, 18 May 2024 08:00:02 GMT
Screenshot%202024-04-11%20at%2010.01.43%20AM.png
www.proofpoint.com/sites/default/files/inline-images/
358 KB
359 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screenshot%202024-04-11%20at%2010.01.43%20AM.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4fffc9e433325201efe66c3a32d653b1c44cd909996cf29ed80ab991b6964b14
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 11 Apr 2024 17:01:58 GMT
X-CDN
Imperva
Etag
"dfa620cc"
Content-Type
image/png
X-Iinfo
5-34955499-0 0CNN RT(1715846238824 2944) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=172976, public
Content-Length
367102
Expires
Sat, 18 May 2024 08:00:17 GMT
6si.min.js
j.6sc.co/
66 KB
18 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 09 May 2024 06:01:25 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"663c66b5-106b3"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
18038
expires
Thu, 16 May 2024 07:57:21 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 16 May 2024 07:41:03 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
978
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Thu, 16 May 2024 09:41:03 GMT
destination
www.googletagmanager.com/gtag/
226 KB
82 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-950296937&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
50a656cd1682bc2ac25d8af9262a2ce1c8848624629366a30c4cd95e086c2648
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
83557
x-xss-protection
0
last-modified
Thu, 16 May 2024 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 16 May 2024 07:57:21 GMT
bat.js
bat.bing.com/
45 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Thu, 16 May 2024 07:57:20 GMT
last-modified
Thu, 29 Feb 2024 19:58:06 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: D52694DD909E4D84B1B1216C3470C744 Ref B: FRAEDGE1917 Ref C: 2024-05-16T07:57:21Z
etag
"01b4e9c496bda1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13261
destination
www.googletagmanager.com/gtag/
200 KB
73 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=DC-10031399&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ce89affdf3ca1fc04cc0ddaed91dfaae11a37561e3fec2dd1e5ea3969b0b575f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
74282
x-xss-protection
0
last-modified
Thu, 16 May 2024 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 16 May 2024 07:57:21 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
47 KB
17 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 06 May 2024 17:20:18 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=13930
accept-ranges
bytes
content-length
16683
1594.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
414 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
x-permitted-cross-domain-policies
none
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection
1; mode=block
x-request-id
19490993-e82d-49af-a280-4c6f6c4ea646
x-runtime
0.004067
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
cf-ray
8849d1000d8e8eb5-FRA
1644.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
422 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
x-permitted-cross-domain-policies
none
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection
1; mode=block
x-request-id
2ebd8e77-130b-4968-bf35-ca75083f9a15
x-runtime
0.006399
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
cf-ray
8849d1000d8c8eb5-FRA
1645.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
x-permitted-cross-domain-policies
none
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection
1; mode=block
x-request-id
6b094c90-f164-4ff1-8bc1-87c869cf349a
x-runtime
0.004064
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
cf-ray
8849d1000d8d8eb5-FRA
1646.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
413 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
x-permitted-cross-domain-policies
none
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection
1; mode=block
x-request-id
8eca51e4-284f-4551-9197-0f75cfe57195
x-runtime
0.005224
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
cf-ray
8849d1000d908eb5-FRA
1647.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
415 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
x-permitted-cross-domain-policies
none
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection
1; mode=block
x-request-id
fcd31ef5-3796-4d6d-bb5a-57bf83e2504f
x-runtime
0.032477
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
cf-ray
8849d1000d928eb5-FRA
5dfsgn7m2kst.js
js.driftt.com/include/1715846400000/
221 KB
62 KB
Script
General
Full URL
https://js.driftt.com/include/1715846400000/5dfsgn7m2kst.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-87.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b5ef7dd34cf17eb441a01a651d089e520dff86ae2337ff95ee079f46a394880a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-version-id
Z_PrOFTRMvL4O0aYU62zlt9FokvO7ucK
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Thu, 16 May 2024 07:57:21 GMT
via
1.1 218c6128df18321f9758e53ccc351448.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P6
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
34
last-modified
Fri, 03 May 2024 15:33:08 GMT
server
istio-envoy
etag
W/"cb9fee71607daf9b9d3bb7b3d5abc6da"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
PodwAdQRauDgmIogcZ7vzaNpKxNkSsGDGyWCY-2bI3KzE4YRIX-uRQ==
fbevents.js
connect.facebook.net/en_US/
218 KB
59 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 16 May 2024 07:57:21 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
57845
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=5, rtx=0, c=12, mss=1326, tbw=2773, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma
public
x-fb-debug
LswlfM8ISn4KazWCbC+BndNlgemoO2leWW0m7zWa2MBisewRoCvVlMFe31+0gEcBZkKEHdEDDVVesEWe+9Er6A==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:973c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security
max-age=0; includeSubDomains; preload
age
58978
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1200
cf-ray
8849d1003bd03a8e-FRA
expires
Thu, 16 May 2024 08:17:21 GMT
events.js
tags.srv.stackadapt.com/
18 KB
7 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.157.234.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-234-167.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
1a6a1d377a58ebff94ff1104a484950dd0147cdae7089281dd85e2dc50adcae7

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
date
Thu, 16 May 2024 07:57:21 GMT
cache-control
max-age=5
content-encoding
gzip
content-type
text/javascript
report-csp-violation
www.proofpoint.com/
0
7 KB
Other
General
Full URL
https://www.proofpoint.com/report-csp-violation
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/csp-report

Response headers

X-Content-Security-Policy
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
Date
Thu, 16 May 2024 07:57:22 GMT
Content-Security-Policy
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Via
varnish
X-Permitted-Cross-Domain-Policies
none
X-CDN
Imperva
Age
0
X-Cache
MISS
X-Iinfo
6-37942377-37942657 NNNN CT(122 249 0) RT(1715846239489 2302) q(0 0 4 -1) r(7 7) U6
Connection
keep-alive
X-AH-Environment
prod
Content-Length
0
X-Request-ID
v-ed5bc584-1359-11ef-ba89-d760f93e2f89
Referrer-Policy
origin-when-cross-origin
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-language
en
Content-Type
text/html; charset=UTF-8
Cache-Control
must-revalidate, no-cache, private
Feature-Policy
geolocation 'self'
x-incap-sess-cookie-hdr
Y7XQaxBVXnIESrmDFfj4EGK8RWYAAAAA6tLwQJWLVzQLugiYd2dDAw==
Accept-Ranges
bytes
X-WebKit-CSP
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
Expires
Fri, 17 May 2024 07:57:22 GMT
d454424c4514a20a.js
client-registry.mutinycdn.com/personalize/client/
0
0

/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=6131264085712994859
4 B
282 B
Image
General
Full URL
https://attr.ml-api.io/?domain=proofpoint.com&pId=6131264085712994859
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Server
2600:9000:206f:fe00:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Thu, 16 May 2024 07:57:22 GMT
via
1.1 c888f786e25e6e3c7dbb7e9da462d714.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-cache
Miss from cloudfront
content-type
application/json
alt-svc
h3=":443"; ma=86400
content-length
4
apigw-requestid
X2pfXjwXIAMEPfQ=
x-amz-cf-id
GmN1Ql94UxY-yipGYXLHFmuOv08EfyyqIIRauaAKcgwvjNvWHVd9JQ==

Redirect headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
an-x-request-uuid
26449314-f14b-4792-b293-1e92863d0735
server
nginx/1.23.4
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://attr.ml-api.io/?domain=proofpoint.com&pId=6131264085712994859
x-proxy-origin
45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-B1V8SZE3GL&gtm=45je45f0v890103917za200&_p=1715846239564&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1332484325.1715846240&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1715846239&sct=1&seg=0&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&dt=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&en=scroll&epn.percent_scrolled=90&_et=4&tfd=2531
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
4 B
211 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1888990812&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&ul=de-de&de=UTF-8&dt=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAEK~&jid=1385669530&gjid=1915615391&cid=1332484325.1715846240&tid=UA-2257074-1&_gid=1637120504.1715846241&_r=1&_slc=1&gtm=45He45f0n81MGR7P8Xv76619393za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd19=1332484325.1715846240&npa=1&z=182167160
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
17087961.js
bat.bing.com/p/action/
0
116 B
Script
General
Full URL
https://bat.bing.com/p/action/17087961.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Thu, 16 May 2024 07:57:20 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: A3726594BD3547249AF5D8766DBECE1A Ref B: FRAEDGE1917 Ref C: 2024-05-16T07:57:21Z
x-cache
CONFIG_NOCACHE
collect
stats.g.doubleclick.net/j/
4 B
151 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-2257074-1&cid=1332484325.1715846240&jid=1385669530&gjid=1915615391&_gid=1637120504.1715846241&npa=1&_u=YADAAEAAAAAAACAEK~&z=2025663663
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Thu, 16 May 2024 07:57:21 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CIaz1q3ZkYYDFYxHHgIdNQANYw;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus...
10031399.fls.doubleclick.net/ Frame 0FB8
Redirect Chain
  • https://10031399.fls.doubleclick.net/activityi;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=https%3A%2F%2Fwww.proofpoint.com%2...
  • https://10031399.fls.doubleclick.net/activityi;dc_pre=CIaz1q3ZkYYDFYxHHgIdNQANYw;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=...
0
0
Document
General
Full URL
https://10031399.fls.doubleclick.net/activityi;dc_pre=CIaz1q3ZkYYDFYxHHgIdNQANYw;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering;u4=undefined;u5=undefined;u6=undefined;u7=undefined;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe45f0z876619393za201;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-10031399&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
478
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 16 May 2024 07:57:21 GMT
expires
Thu, 16 May 2024 07:57:21 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 16 May 2024 07:57:21 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10031399.fls.doubleclick.net/activityi;dc_pre=CIaz1q3ZkYYDFYxHHgIdNQANYw;src=10031399;type=sitev0;cat=becea0;ord=440219162423;npa=1;auiddc=2114315177.1715846241;u2=1332484325.1715846240;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering;u4=undefined;u5=undefined;u6=undefined;u7=undefined;uaa=x86;uab=64;uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe45f0z876619393za201;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-2257074-1&cid=1332484325.1715846240&jid=1385669530&npa=1&_u=YADAAEAAAAAAACAEK~&z=2081578732
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-2257074-1&cid=1332484325.1715846240&jid=1385669530&npa=1&_u=YADAAEAAAAAAACAEK~&z=2081578732
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-t...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-t...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&cookiesTest=true&e_ipv6=AQI25-GzudpUdQAAAY-AZ90_Z5EZwrVy1Y0tmXL01WFObT8ZlHSE2gjtxnuvoGOuaLs14mxuT3xDFS_mnC_CCi8Qj-Kpzw
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: AA0AE768F6844BACBD0577F695FAC639 Ref B: FRAEDGE1109 Ref C: 2024-05-16T07:57:21Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYYjZW7Hcihth+U5jyCJg==

Redirect headers

date
Thu, 16 May 2024 07:57:20 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 3B76339E6C214672ACCD2FC48BEE9947 Ref B: FRAEDGE1910 Ref C: 2024-05-16T07:57:21Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1715846241354&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&cookiesTest=true&e_ipv6=AQI25-GzudpUdQAAAY-AZ90_Z5EZwrVy1Y0tmXL01WFObT8ZlHSE2gjtxnuvoGOuaLs14mxuT3xDFS_mnC_CCi8Qj-Kpzw
x-li-proto
http/2
content-length
0
x-li-uuid
AAYYjZW4ISad2bSxg+NAYw==
/
px.ads.linkedin.com/wa/
0
703 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Accept
*
Referer
https://www.proofpoint.com/
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:20 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: FC41A4880C4D4B358E9CD25BB8B83158 Ref B: FRAEDGE1910 Ref C: 2024-05-16T07:57:21Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
access-control-allow-origin
https://www.proofpoint.com
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYYjZW1rtgG4/AQfHFQeQ==
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.141.31 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-141-31.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sat, 24 Aug 2024 07:57:21 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/
43 B
61 B
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1715846241383&cv=9&fst=1715846241383&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465926%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&tiba=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&uaa=x86&uab=64&uam=&uap=Win32&uapv=10.0.0&uaw=0&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:21 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
143852102935619
connect.facebook.net/signals/config/
65 KB
14 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/143852102935619?v=2.9.156&r=stable&domain=www.proofpoint.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c8eb65b82df3fc24b2b475bdd155953405c4ac91ecf0b5fa58d92b24f9fd058b
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 16 May 2024 07:57:21 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=5, rtx=0, c=63, mss=1326, tbw=63341, tp=-1, tpl=-1, uplat=66, ullat=0
pragma
public
x-fb-debug
KDOZpyKbMdDJthavWwZ/LG1BYrvlgmjnyuadwcm8HlVW6oEZXGbtdOaLTRrNtqRDSdF27WGNzdixD1ZzZRkvug==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
gif.gif
ibc-flow.techtarget.com/a/
43 B
457 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1268939&r=1715846241419&ref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&version=2.4
Requested by
Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
1268939
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:21 GMT
via
1.1 google
x-guploader-uploadid
ABPtcPoTiE9SEWswfoWnDADiOJjDxMeZAKO8_PoZLOjVj8yXKfXI0wZyMtQ9gvncUm8bRU9dDwI8-FAolw
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Thu, 16 May 2024 08:57:21 GMT
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1268939&r=1715846241419&ref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Thu, 16 May 2024 07:57:21 GMT
expires
Thu, 16 May 2024 07:57:21 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
ABPtcPpsbFKa-5qEzGOYl4L2LsZSTBA9Vgh6friJgsrnktbyyI9p-U5OWKkxvHUEiSRhieroe6UgI1wFPQ
sa.css
tags.srv.stackadapt.com/
65 B
203 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.157.234.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-234-167.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
110990cb06ddfd8a81dca4c88cbbf125fb2891dc8c19fc809385b31281f7424a

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
date
Thu, 16 May 2024 07:57:21 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.157.234.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-234-167.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
date
Thu, 16 May 2024 07:57:21 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
content-type
image/jpeg
/
www.facebook.com/tr/
0
273 B
Image
General
Full URL
https://www.facebook.com/tr/?id=143852102935619&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&rl=&if=false&ts=1715846241498&sw=1600&sh=1200&v=2.9.156&r=stable&ec=0&o=4126&fbp=fb.1.1715846241496.1991381320&cs_est=true&ler=empty&cdl=API_unavailable&it=1715846241411&coo=false&rqm=GET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-fb-connection-quality
EXCELLENT; q=0.9, rtt=5, rtx=0, c=10, mss=1326, tbw=2764, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security
max-age=31536000; includeSubDomains
date
Thu, 16 May 2024 07:57:21 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
visitWebPage
309-rhv-619.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://309-rhv-619.mktoresp.com/webevents/visitWebPage?_mchNc=1715846241504&_mchCn=&_mchId=309-RHV-619&_mchTk=_mch-proofpoint.com-1715846241503-40499&_mchHo=www.proofpoint.com&_mchPo=&_mchRu=%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:21 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
33aaa3f5-ca2c-4209-9da0-182a05ff856e
saq_pxl
tags.srv.stackadapt.com/
185 B
381 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=dG-GbvdPxi8YOQyjVLjRlg&is_js=true&landing_url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&t=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&tip=wGb-ixTpGm_mHEFFxPIATDn_IQJoS0_vlgUWsNSjeD8&host=https%3A%2F%2Fwww.proofpoint.com&sa_conv_data_css_value=%270-424ecd0e-23ed-533c-74e6-7c2cfef60731%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9424ecd0e23ed533c74e67c2cfef607312d8d9848&sa-user-id-v3=s%253AAQAKIJdufp-GUa-fcarBVQ7emNnFUVQioU2m3-rToVXA6qSFEHwYBCDh-JayBjABOgS9M-cxQgQQwI-q.l0x7PkP9cYw2Tei4jdVbtco25C00bQ869%252B7kHs5KWHE&sa-user-id-v2=s%253AQk7NDiPtUzx05nws_vYHMS2NmEg.oiGQU52AW9yq3d6%252F1pDuow1oCNi%252BTxXGukL9YMxlePo&sa-user-id=s%253A0-424ecd0e-23ed-533c-74e6-7c2cfef60731.6lbLo%252BZuEzK6IrO6BLXsIqkpSAtl8bc6LUDWHFQw1RM
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.157.234.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-234-167.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
00a028b6540a3f5309fccc8c5c6d5d5e1da884807e21931d907f29f7247ea734

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Thu, 16 May 2024 07:57:21 GMT
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
185
access-control-allow-methods
GET
content-type
text/plain; charset=utf-8
442f89a5-4b47-4e06-93ab-c90ffaeb396c
https://www.proofpoint.com/
43 B
0
Image
General
Full URL
blob:https://www.proofpoint.com/442f89a5-4b47-4e06-93ab-c90ffaeb396c
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
me
geoip-js.com/geoip/v2.1/country/
736 B
936 B
XHR
General
Full URL
https://geoip-js.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.proofpoint.com
Requested by
Host: geoip-js.com
URL: https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:216e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08877ec4f8e5936e2d57bf3c510f03d7cfd4e081c206c99d97776b820f69ae62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
8849d1064b099004-FRA
content-length
736
getForm
app-abj.marketo.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getForm?munchkinId=309-RHV-619&form=19277&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&callback=jQuery371016652397219309512_1715846242255&_=1715846242256
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
989ad4866106466cdfb29b515b0271c7f568eb08f5a248e4ad7f77b0b4bdb784

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:22 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-form-service-request-id
15003#18f8067e089
x-marketo-source
Form Service
cf-ray
8849d10638051da6-FRA
cached
false
facebook.svg
platform-cdn.sharethis.com/img/
301 B
743 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/facebook.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:5e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 12 May 2024 06:53:48 GMT
via
1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA50-C1
age
349415
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
301
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"c6e9be45643e197ce1db1d7e24a99adc"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
x-amz-cf-id
48Rnq-mtkSNVnGg7MjapEzEBcNmcHnbG5g3M1qpIb5PEsaCfQb9eiQ==
twitter.svg
platform-cdn.sharethis.com/img/
368 B
781 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/twitter.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:5e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:54:38 GMT
via
1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 15 Sep 2023 16:58:49 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
164
x-amz-server-side-encryption
AES256
etag
"2deb3d5121d475d195577a70b0a91a0c"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
368
x-amz-cf-id
zBwRKkVY8oOFqZaIKCIltGxmTlWOoJyLVAApfPLdCoAM8G6U5Do2yg==
linkedin.svg
platform-cdn.sharethis.com/img/
456 B
882 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:5e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 19 Apr 2024 04:16:53 GMT
via
1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
2346030
etag
"fa43b4ede18498b114fc7185993f6da7"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
456
x-amz-cf-id
u7hshf4JHV-bghn1pPPsvX-LgfmiJ8U9Rxmn8ZTG-dJOyluyyywO4Q==
email.svg
platform-cdn.sharethis.com/img/
343 B
769 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/email.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:5e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 09 May 2024 04:44:48 GMT
via
1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
2138892
x-amz-server-side-encryption
AES256
etag
"5977437466e857c7ddcadda6f6d88c2a"
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
343
x-amz-cf-id
CU4ztl9b9PKDaE__MwZ5JEQdgWpqs4iqBtLuKapG0P13nvSD9uM8Aw==
activityi;dc_pre=COCmjq7ZkYYDFZtFHgIdZUwOkg;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193
4788165.fls.doubleclick.net/ Frame 2031
Redirect Chain
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193?
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=COCmjq7ZkYYDFZtFHgIdZUwOkg;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193?
0
0
Document
General
Full URL
https://4788165.fls.doubleclick.net/activityi;dc_pre=COCmjq7ZkYYDFZtFHgIdZUwOkg;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
1893
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 16 May 2024 07:57:22 GMT
expires
Thu, 16 May 2024 07:57:22 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 16 May 2024 07:57:22 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://4788165.fls.doubleclick.net/activityi;dc_pre=COCmjq7ZkYYDFZtFHgIdZUwOkg;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6513691500692.193?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
0
bat.bing.com/action/
0
286 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=17087961&tm=gtm002&Ver=2&mid=a0706046-28ec-441f-b17f-d5b2b4ac3b6b&sid=ed203d80135911ef9a8a1117c7b441c5&vid=ed2041e0135911ef8c48792dc58b087d&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&p=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&r=&lt=3682&evt=pageLoad&sv=1&rn=123836
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 16 May 2024 07:57:21 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F5DD93EDC90F457C82F43B72EA7CC8AE Ref B: FRAEDGE1917 Ref C: 2024-05-16T07:57:22Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
getForm
app-abj.marketo.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getForm?munchkinId=309-RHV-619&form=19277&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&callback=jQuery371016652397219309512_1715846242257&_=1715846242258
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cfeab03a9be2423c0e828558c5f0b05235ced0efc8810fd90f0fc2ec00ce931

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:23 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-form-service-request-id
12511#18f8067e093
x-marketo-source
Form Service
cf-ray
8849d106988c1da6-FRA
cached
false
DE.png
www.proofpoint.com/modules/custom/pp_i18n/images/
3 KB
4 KB
Image
General
Full URL
https://www.proofpoint.com/modules/custom/pp_i18n/images/DE.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
013ebc8682bafe775a56f93904cff8456974906327dad3524e2ab2fe0c0df700
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:22 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 09 Apr 2024 22:57:48 GMT
X-CDN
Imperva
Etag
"cc0c264c"
Content-Type
image/png
X-Iinfo
6-37942376-0 0CNN RT(1715846239488 2522) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=222940, public
Content-Length
3329
Expires
Sat, 18 May 2024 21:53:02 GMT
forms2.css
app-abj.marketo.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
240
content-length
2623
last-modified
Tue, 23 Apr 2024 04:13:58 GMT
server
cloudflare
etag
"121c67-3437-616bbc873ed80"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
8849d10a6f8f1da6-FRA
expires
Thu, 16 May 2024 11:57:22 GMT
forms2-theme-plain.css
app-abj.marketo.com/js/forms2/css/
828 B
383 B
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63113904
cf-cache-status
HIT
age
3381
content-length
246
last-modified
Tue, 23 Apr 2024 04:13:58 GMT
server
cloudflare
etag
"121c65-33c-616bbc873ed80"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
8849d10a7f911da6-FRA
expires
Thu, 16 May 2024 11:57:23 GMT
getKnownLead
app-abj.marketo.com/index.php/form/
49 B
250 B
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getKnownLead?form=19277&lpId=&munchkinId=309-RHV-619&filledFields=true&_mkt_trk=id%3A309-RHV-619%26token%3A_mch-proofpoint.com-1715846241503-40499&callback=jQuery371016652397219309512_1715846242255&_=1715846242259
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6411c1a319b14238b941f27f2db724c769158d7d3a84814dbb46255e14129f4e
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:23 GMT
strict-transport-security
max-age=63113904
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
server
cloudflare
content-type
application/javascript; charset=utf-8
cf-ray
8849d10a7f931da6-FRA
getKnownLead
app-abj.marketo.com/index.php/form/
49 B
247 B
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getKnownLead?form=19277&lpId=&munchkinId=309-RHV-619&filledFields=true&_mkt_trk=id%3A309-RHV-619%26token%3A_mch-proofpoint.com-1715846241503-40499&callback=jQuery371016652397219309512_1715846242257&_=1715846242260
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1efc356399045f3789863eafdb41484a9000a91b1d5eafdfe8237bb33a3374a2
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:23 GMT
strict-transport-security
max-age=63113904
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
server
cloudflare
content-type
application/javascript; charset=utf-8
cf-ray
8849d10b08811da6-FRA
truncated
/
584 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3666e420f1e9ea50d544484f433bb0613fe24e0891935549f12ab937e379440

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
XDFrame
app-abj.marketo.com/index.php/form/ Frame D2D2
0
0
Document
General
Full URL
https://app-abj.marketo.com/index.php/form/XDFrame
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
8849d10e0ca565dc-FRA
content-encoding
gzip
content-length
650
content-type
text/html; charset=utf-8
date
Thu, 16 May 2024 07:57:23 GMT
server
cloudflare
strict-transport-security
max-age=63113904
vary
Accept-Encoding
x-content-type-options
nosniff
core
js.driftt.com/ Frame 537C
0
0
Document
General
Full URL
https://js.driftt.com/core?d=1&embedId=5dfsgn7m2kst&eId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=dd0415eb-0a94-46ed-8d2b-3a97994e50fb&sessionStarted=1715846244.017&campaignRefreshToken=d8cce813-8572-4699-9e31-ba2f24fda4bf&hideController=false&pageLoadStartTime=1715846239812&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1715846400000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-77.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 16 May 2024 07:57:24 GMT
etag
W/"bfed674d771366425d072381f4efc1f7"
last-modified
Fri, 03 May 2024 15:32:45 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
x-amz-cf-id
EtlVcEbKSKMOQelCEL7anipFr7mXAyehSqRdW00A67R2JqUaNY99wg==
x-amz-cf-pop
FRA60-P6
x-amz-server-side-encryption
AES256
x-amz-version-id
S5LI.Dztu4EwHCgPf20gC00X3KqcCutb
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
19
chat
js.driftt.com/core/ Frame 96EF
0
0
Document
General
Full URL
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1715846239812
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1715846400000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-77.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 16 May 2024 07:57:24 GMT
etag
W/"bfed674d771366425d072381f4efc1f7"
last-modified
Fri, 03 May 2024 15:32:45 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
x-amz-cf-id
NprPznESiXT-z14v4DeSLPU5zIsMUIafQ4kwkRX6eqDJ9WlV6GDvPQ==
x-amz-cf-pop
FRA60-P6
x-amz-server-side-encryption
AES256
x-amz-version-id
S5LI.Dztu4EwHCgPf20gC00X3KqcCutb
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
18
/
c.6sc.co/
7 B
196 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:24 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.proofpoint.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
36 B
342 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:2100::58dd:c512 Munich, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9afc67691749451c5fc73c4f1f0964d8937508b7446a9133ea6ebf731e7bd520

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:24 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.proofpoint.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:ac8:20:3d00:1011:89bb:cb2e:b5a1
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715846244074_1490928910_301431498_25_850_17_36_219";dur=1
content-length
36
expires
Thu, 16 May 2024 07:57:24 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
259 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&visitor=8ea4f7df-b4ea-4595-88cc-24ac988d65f3&session=65d83882-b120-46a6-8b34-d1666d95195a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2016%20May%202024%2007%3A57%3A22%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20takeaways%E2%80%AF%C2%A0%20TA427%20regularly%20engages%20in%20benign%20conversation%20starter%20campaigns%20to%20establish%20contact%20with%20targets%20for%20long-term%20exchanges%20of%20information%20on%20topics%20of%20strategic%20importance%20to%20the%20No...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%26nbsp%3B%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&pageViewId=24cc4254-43cf-4652-802a-730a1de84bee&v=1.1.20
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:24 GMT
x-content-type-options
nosniff
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Thu, 16 May 2024 07:57:24 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
260 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&visitor=8ea4f7df-b4ea-4595-88cc-24ac988d65f3&session=65d83882-b120-46a6-8b34-d1666d95195a&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2007%3A57%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2276d4adecd2340b300ba5d4296ecef89d%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2007%3A57%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2007%3A57%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22cf897ce61a58c53c1861f742ebebc2622f6b0fcf%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2007%3A57%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2007%3A57%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20takeaways%E2%80%AF%C2%A0%20TA427%20regularly%20engages%20in%20benign%20conversation%20starter%20campaigns%20to%20establish%20contact%20with%20targets%20for%20long-term%20exchanges%20of%20information%20on%20topics%20of%20strategic%20importance%20to%20the%20No...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%26nbsp%3B%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&pageViewId=24cc4254-43cf-4652-802a-730a1de84bee&v=1.1.20
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:24 GMT
x-content-type-options
nosniff
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Thu, 16 May 2024 07:57:24 GMT
zi-tag.js
js.zi-scripts.com/
9 KB
3 KB
Script
General
Full URL
https://js.zi-scripts.com/zi-tag.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3ea3a972768896d2a84d6eb36d3f5919478ad9c091477c22a5362eb6d53aee4

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:24 GMT
x-amz-version-id
4TVPkf0eH3kVl0Vjj3KPZI_FUiecs6et
via
1.1 9ac192ffc1203361ea1141b56df84966.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
content-encoding
gzip
x-amz-cf-pop
AMS58-P3
age
4790
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 15 May 2024 06:37:27 GMT
server
cloudflare
etag
W/"5c7228fc2640a4dfce48217428980fe3"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
8849d1116e439b71-FRA
x-amz-cf-id
PcRdfRuSVuUBfV0lNirMpi8akxlEEN9t8e4nd09wihBmvkiuFp21Rw==
getSubscriptions
js.zi-scripts.com/unified/v1/master/
150 B
523 B
Fetch
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
6cb9dea6bff9a1a74e1a7cb70542259e72698c2afddbaa921ccfe9391670c55b

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
Authorization
Bearer 13181347861669635920
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.proofpoint.com/
visited_url
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering

Response headers

date
Thu, 16 May 2024 07:57:24 GMT
via
1.1 a43889f6531338b6dd9d3a4339de949a.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
x-amz-cf-pop
AMS58-P3
x-powered-by
Express
x-cache
Miss from cloudfront
alt-svc
h3=":443"; ma=86400
apigw-requestid
X2pfuiTBvHcEMGg=
server
cloudflare
etag
W/"96-f6KlkLq5D1TZkeVpRF0rvREfyig"
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cf-ray
8849d112fa7c1965-FRA
x-amz-cf-id
Z_yW7Vjv4yly1pc4ZwVm3yKQG5fWFf91v81pj4vZCAoDFBRzRw1g3w==
getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame
0
0
Preflight
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type,visited_url
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
access-control-max-age
0
alt-svc
h3=":443"; ma=86400
apigw-requestid
X2pftjGSPHcEM2A=
cf-cache-status
DYNAMIC
cf-ray
8849d111b8e31965-FRA
date
Thu, 16 May 2024 07:57:24 GMT
server
cloudflare
vary
Access-Control-Request-Headers
via
1.1 c3919dfed58c39e6da91faec1344110c.cloudfront.net (CloudFront)
x-amz-cf-id
gLk62EnGta2NbR8tabc8tEHYb-D49MfyXyQKQzVEHmf9PfYvyvUy_w==
x-amz-cf-pop
AMS58-P3
x-cache
Miss from cloudfront
x-powered-by
Express
img.gif
b.6sc.co/v1/beacon/
43 B
260 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&visitor=8ea4f7df-b4ea-4595-88cc-24ac988d65f3&session=65d83882-b120-46a6-8b34-d1666d95195a&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3d00%3A1011%3A89bb%3Acb2e%3Ab5a1%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20takeaways%E2%80%AF%C2%A0%20TA427%20regularly%20engages%20in%20benign%20conversation%20starter%20campaigns%20to%20establish%20contact%20with%20targets%20for%20long-term%20exchanges%20of%20information%20on%20topics%20of%20strategic%20importance%20to%20the%20No...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%26nbsp%3B%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&pageViewId=24cc4254-43cf-4652-802a-730a1de84bee&v=1.1.20
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:24 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Thu, 16 May 2024 07:57:24 GMT
details
epsilon.6sense.com/v3/company/
745 B
722 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software
nginx /
Resource Hash
4160094e8e7a55a3dd60c62de930a81375ddce09c11dc6d7b28332da6dbbdf14

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
Authorization
Token cf897ce61a58c53c1861f742ebebc2622f6b0fcf
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-6s-CustomID
WebTag1.0 76d4adecd2340b300ba5d4296ecef89d
Referer
https://www.proofpoint.com/
sec-ch-ua-platform
"Win32"

Response headers

x-trace-id
7802959809927324967
date
Thu, 16 May 2024 07:57:24 GMT
content-encoding
gzip
server
nginx
vary
Origin, Accept-Encoding
content-type
application/json
x-6si-region
eu-central-1a
access-control-allow-origin
https://www.proofpoint.com
access-control-expose-headers
X-6si-Region
access-control-allow-credentials
true
timing-allow-origin
https://6sense.com, https://www.ssga.com
content-length
399
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.proofpoint.com
access-control-expose-headers
X-6si-Region
access-control-max-age
1800
date
Thu, 16 May 2024 07:57:24 GMT
server
nginx
timing-allow-origin
https://6sense.com, https://www.ssga.com
x-6si-region
eu-central-1a
x-trace-id
7289356915912296414
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=1888990812&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&ul=de-de&de=UTF-8&dt=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aADAAEABAAAAACAEK~&jid=&gjid=&cid=1332484325.1715846240&tid=UA-2257074-1&_gid=1637120504.1715846241&gtm=45He45f0n81MGR7P8Xv76619393za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd19=1332484325.1715846240&cd2=&cd3=&cd5=&cd6=&cd10=Frankfurt%20am%20Main&cd11=Hesse&cd12=Germany&cd17=&npa=1&z=1466142681
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 15 May 2024 13:59:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
64687
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
17 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-B1V8SZE3GL&gtm=45je45f0v890103917z876619393za200&_p=1715846239564&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1332484325.1715846240&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=AAAC&_s=3&sid=1715846239&sct=1&seg=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&dt=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&en=page_view&_et=1436&tfd=5657
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:24 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
favicon.ico
www.proofpoint.com/themes/custom/proofpoint/apps/drupal/
8 KB
8 KB
Other
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/apps/drupal/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
c45c82a27f734de8594f06f5e4e0706d5452131d8cbb8be42e18233af4b374e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:24 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"ed4d56a0"
Content-Type
image/vnd.microsoft.icon
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 4584) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=316706, public
Content-Length
7990
Expires
Sun, 19 May 2024 23:55:50 GMT
/
ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/
3 KB
2 KB
Fetch
General
Full URL
https://ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/?iszitag=true
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
d397a80cd56a7cc222adee293dd1fe489aecc3b5887c7fdc568c1b6eebafe6e9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
text/javascript
visited-url
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
_vtok
NDUuMTQxLjE1Mi43Mg==
_zitok
8e414d047704d8b4f8da1715846244
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 07:57:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
https://www.proofpoint.com
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc
h3=":443"; ma=86400
cf-ray
8849d1153a7fbb44-FRA
/
ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/?iszitag=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
_vtok,_zitok,content-type,visited-url
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin
https://www.proofpoint.com
allow
GET,HEAD
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8849d1143abd0404-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 16 May 2024 07:57:24 GMT
server
cloudflare
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
favicon-32x32.png
www.proofpoint.com/themes/custom/proofpoint/apps/drupal/images/favicons/
961 B
1 KB
Other
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-32x32.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
006cdaab6ca61d79b8fecd9bb8a71fc9cf21e292d85b9d34d8a15ccce62c5f27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 16 May 2024 07:57:24 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 09 Apr 2024 22:57:49 GMT
X-CDN
Imperva
Etag
"11b1dbd8"
Content-Type
image/png
X-Iinfo
6-37942377-0 0CNN RT(1715846239489 4865) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=293953, public
Content-Length
961
Expires
Sun, 19 May 2024 17:36:37 GMT
b8a81cc2-c856-4711-af75-7fc870fdd3a0
https://www.proofpoint.com/
3 KB
0
Script
General
Full URL
blob:https://www.proofpoint.com/b8a81cc2-c856-4711-af75-7fc870fdd3a0
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d397a80cd56a7cc222adee293dd1fe489aecc3b5887c7fdc568c1b6eebafe6e9

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length
2915
Content-Type
text/javascript
img.gif
b.6sc.co/v1/beacon/
43 B
260 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&visitor=8ea4f7df-b4ea-4595-88cc-24ac988d65f3&session=65d83882-b120-46a6-8b34-d1666d95195a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2007%3A57%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2007%3A57%3A22%20GMT%22%2C%22timeSpent%22%3A%222936%22%2C%22totalTimeSpent%22%3A%222936%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20takeaways%E2%80%AF%C2%A0%20TA427%20regularly%20engages%20in%20benign%20conversation%20starter%20campaigns%20to%20establish%20contact%20with%20targets%20for%20long-term%20exchanges%20of%20information%20on%20topics%20of%20strategic%20importance%20to%20the%20No...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%26nbsp%3B%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&pageViewId=24cc4254-43cf-4652-802a-730a1de84bee&v=1.1.20
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:25 GMT
x-content-type-options
nosniff
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Thu, 16 May 2024 07:57:25 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=1888990812&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&ul=de-de&de=UTF-8&dt=From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%C2%A0%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Playbook%20Fired&el=Playbook%20ID%3A%202592682&_u=aDDAAEABAAAAACAEK~&jid=&gjid=&cid=1332484325.1715846240&tid=UA-2257074-1&_gid=1637120504.1715846241&gtm=45He45f0n81MGR7P8Xv76619393za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd19=1332484325.1715846240&npa=1&z=1227119672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 15 May 2024 13:59:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
64688
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
259 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&visitor=8ea4f7df-b4ea-4595-88cc-24ac988d65f3&session=65d83882-b120-46a6-8b34-d1666d95195a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2007%3A57%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2007%3A57%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223937%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20takeaways%E2%80%AF%C2%A0%20TA427%20regularly%20engages%20in%20benign%20conversation%20starter%20campaigns%20to%20establish%20contact%20with%20targets%20for%20long-term%20exchanges%20of%20information%20on%20topics%20of%20strategic%20importance%20to%20the%20No...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%26nbsp%3B%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&pageViewId=24cc4254-43cf-4652-802a-730a1de84bee&v=1.1.20
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:26 GMT
x-content-type-options
nosniff
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Thu, 16 May 2024 07:57:26 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
260 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&visitor=8ea4f7df-b4ea-4595-88cc-24ac988d65f3&session=65d83882-b120-46a6-8b34-d1666d95195a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2007%3A57%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2007%3A57%3A26%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224938%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20takeaways%E2%80%AF%C2%A0%20TA427%20regularly%20engages%20in%20benign%20conversation%20starter%20campaigns%20to%20establish%20contact%20with%20targets%20for%20long-term%20exchanges%20of%20information%20on%20topics%20of%20strategic%20importance%20to%20the%20No...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22From%20Social%20Engineering%20to%20DMARC%20Abuse%3A%20TA427%E2%80%99s%20Art%20of%20Information%20Gathering%26nbsp%3B%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fsocial-engineering-dmarc-abuse-ta427s-art-information-gathering&pageViewId=24cc4254-43cf-4652-802a-730a1de84bee&v=1.1.20
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.176.179 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-19-176-179.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.proofpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 16 May 2024 07:57:27 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Thu, 16 May 2024 07:57:27 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
client-registry.mutinycdn.com
URL
https://client-registry.mutinycdn.com/personalize/client/d454424c4514a20a.js

Verdicts & Comments Add Verdict or Comment

173 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| dataLayer function| gtag boolean| use_existing_jquery number| is_spa string| hide_element boolean| f object| d object| code number| settings_timer number| _vwo_settings_timer object| _vwo_code number| _vwo_j_e string| _vwo_mt string| _vwo_tm string| _vwo_cookieDomain number| _vwo_acc_id object| vwo_iehack_queue object| VWO object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| ua_fields function| postscribe object| google_tag_manager_external function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si string| GoogleAnalyticsObject function| ga object| parts object| vimeoGAJS string| _linkedin_partner_id object| _linkedin_data_partner_ids function| drift undefined| driftt function| fbq function| _fbq object| techtargetic function| lintrk function| saq function| _saq object| zi string| ZIProjectKey object| mutiny object| gaplugins object| gaData function| UET function| UET_init function| UET_push object| ueto_ccbb9601c0 object| uetq boolean| _already_called_lintrk object| ORIBILI function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| google_conversion_id object| google_custom_params object| google_remarketing_only function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments function| once function| _ function| jQuery undefined| $ object| Backbone object| drupalSettings object| Drupal object| tabbable object| Cookies object| geoip2 function| loadjs function| BaseClass boolean| google_noFurtherRedirects object| 3eiXJRXgVuLsYGH9303q object| regeneratorRuntime object| _driftFrames object| __post_robot_10_0_46__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked object| MunchkinTracker object| res object| saCookies string| current_window_url_param object| webpackJsonp object| core function| setImmediate function| clearImmediate boolean| _babelPolyfill object| FontAwesomeConfig object| ___FONT_AWESOME___ boolean| VimeoPlayerResizeEmbeds_ boolean| VimeoSeoMetadataAppended boolean| VimeoCheckedUrlTimeParam function| saveAs object| MktoForms2 function| subscribeToMarketoFormEvent string| axel number| a function| addCaptchaScript object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id object| drift_frameFactory object| drift_audio_context object| zitag function| errorHandler boolean| _storagePopulated object| drift_sentry_config object| ziws

45 Cookies

Domain/Path Name / Value
.proofpoint.com/ Name: visid_incap_177663
Value: nrtykTokThaPYgwSsNKAwV68RWYAAAAAQUIPAAAAAABRQ5CzcFXhHxhi4UQRsSTN
.proofpoint.com/ Name: incap_ses_1223_177663
Value: 94aeAEWk93oESrmDFfj4EF68RWYAAAAA3SumBWRicJKRdmUYEB1h5g==
.proofpoint.com/ Name: _vwo_uuid_v2
Value: D81E81C0A209E2CB8C8A2CE49D127CA66|f5a8cf16e2f47e260681c6118debf8f5
.proofpoint.com/ Name: _gcl_au
Value: 1.1.2114315177.1715846241
.proofpoint.com/ Name: _ga
Value: GA1.2.1332484325.1715846240
.proofpoint.com/ Name: _gid
Value: GA1.2.1637120504.1715846241
.proofpoint.com/ Name: _gat_UA-2257074-1
Value: 1
.techtarget.com/ Name: __cf_bm
Value: qQENaJoSlaUsoAtXEcspS1tgpgmIBw0wfNZ_Ch7p_Mg-1715846241-1.0.1.1-RSySfspydHcn_NDXmPbWJgSdJJ.Yed6eYl0sr9Vst6Gmt_rAsU_TcXhRRQIKy6alSUspSJzPu63rgkNE7SyyVw
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-424ecd0e-23ed-533c-74e6-7c2cfef60731.6lbLo%2BZuEzK6IrO6BLXsIqkpSAtl8bc6LUDWHFQw1RM
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-424ecd0e-23ed-533c-74e6-7c2cfef60731.6lbLo%2BZuEzK6IrO6BLXsIqkpSAtl8bc6LUDWHFQw1RM
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AQk7NDiPtUzx05nws_vYHMS2NmEg.oiGQU52AW9yq3d6%2F1pDuow1oCNi%2BTxXGukL9YMxlePo
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AQk7NDiPtUzx05nws_vYHMS2NmEg.oiGQU52AW9yq3d6%2F1pDuow1oCNi%2BTxXGukL9YMxlePo
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIJdufp-GUa-fcarBVQ7emNnFUVQioU2m3-rToVXA6qSFEHwYBCDh-JayBjABOgS9M-cxQgQQwI-q.l0x7PkP9cYw2Tei4jdVbtco25C00bQ869%2B7kHs5KWHE
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIJdufp-GUa-fcarBVQ7emNnFUVQioU2m3-rToVXA6qSFEHwYBCDh-JayBjABOgS9M-cxQgQQwI-q.l0x7PkP9cYw2Tei4jdVbtco25C00bQ869%2B7kHs5KWHE
www.proofpoint.com/ Name: sa-user-id
Value: s%253A0-424ecd0e-23ed-533c-74e6-7c2cfef60731.6lbLo%252BZuEzK6IrO6BLXsIqkpSAtl8bc6LUDWHFQw1RM
www.proofpoint.com/ Name: sa-user-id-v2
Value: s%253AQk7NDiPtUzx05nws_vYHMS2NmEg.oiGQU52AW9yq3d6%252F1pDuow1oCNi%252BTxXGukL9YMxlePo
www.proofpoint.com/ Name: sa-user-id-v3
Value: s%253AAQAKIJdufp-GUa-fcarBVQ7emNnFUVQioU2m3-rToVXA6qSFEHwYBCDh-JayBjABOgS9M-cxQgQQwI-q.l0x7PkP9cYw2Tei4jdVbtco25C00bQ869%252B7kHs5KWHE
.linkedin.com/ Name: lidc
Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2898:u=1:x=1:i=1715846241:t=1715932641:v=2:sig=AQF4sXRVKLZhCOxnid6fs3lbubmDjn1y"
.proofpoint.com/ Name: _fbp
Value: fb.1.1715846241496.1991381320
.doubleclick.net/ Name: IDE
Value: AHWqTUlfBCOKd1L6EvXsKQDkn15rgT-z6ogNfv4IZMUHMfyP4Py2qzYT0h76S3WCKPg
.doubleclick.net/ Name: receive-cookie-deprecation
Value: 1
.proofpoint.com/ Name: _mkto_trk
Value: id:309-RHV-619&token:_mch-proofpoint.com-1715846241503-40499
.linkedin.com/ Name: li_sugr
Value: 0a7205f7-837c-46a6-b823-a5517661bba0
.linkedin.com/ Name: bcookie
Value: "v=2&c2d17003-d57d-4e17-88f5-5a920e825970"
tracking.g2crowd.com/ Name: _session_id
Value: 5f73e3556d94118c66bc3040121fd860
.g2crowd.com/ Name: __cf_bm
Value: nDQozCvky.xksMwlVzAj7A11WOVBOCq4Ggvl8nctbSM-1715846241-1.0.1.1-jhIrPY4jGZc7jeX0n0md7gCF6KXKIWFtCBJdwz0P65K93QTESssXoJOFqJjYseLyb29ybJ9fsaHQ.1fBIbamTA
.linkedin.com/ Name: li_gc
Value: MTswOzE3MTU4NDYyNDE7MjswMjFfGKjpb0UsZflVTaWdRjD5ao6196Dt1La9M/t7vzecAQ==
.adnxs.com/ Name: XANDR_PANID
Value: ohVuBxWDZUX58Z_Fx46H08mq8XqcZjs7Kpa-yrOYboLq_D3hYwRp-g9mEif6_vjjv9RCrN16h2sUK5LR3wkARGadtsegG5IRRqIZZpqO9TI.
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
.adnxs.com/ Name: uuid2
Value: 6131264085712994859
www.proofpoint.com/ Name: hide_lang_switcher
Value: 1
.proofpoint.com/ Name: _uetsid
Value: ed203d80135911ef9a8a1117c7b441c5
.proofpoint.com/ Name: _uetvid
Value: ed2041e0135911ef8c48792dc58b087d
www.proofpoint.com/ Name: pp_user_country
Value: de
.bing.com/ Name: MUID
Value: 2B38F994D0D3618E03C1ED15D1D360B4
.app-abj.marketo.com/ Name: __cf_bm
Value: EAXii4CqT0j2UoUPvDKJAl.x85mhQ5wqr.mfpGBh3Bk-1715846243-1.0.1.1-vfZt_70G79eXFcYir1x.2ur.l3d8MW4X2NdT8LcjR9VQs.lPIrHxsjRdgjhgJO7IGDe195zvD1.1_gZnULjAbQ
www.proofpoint.com/ Name: drift_campaign_refresh
Value: d8cce813-8572-4699-9e31-ba2f24fda4bf
www.proofpoint.com/ Name: _gd_visitor
Value: 8ea4f7df-b4ea-4595-88cc-24ac988d65f3
www.proofpoint.com/ Name: _gd_session
Value: 65d83882-b120-46a6-8b34-d1666d95195a
.proofpoint.com/ Name: _ga_B1V8SZE3GL
Value: GS1.1.1715846239.1.1.1715846244.55.0.0
.www.proofpoint.com/ Name: _zitok
Value: 8e414d047704d8b4f8da1715846244
www.proofpoint.com/ Name: drift_aid
Value: b7d5230e-ca40-43f3-bc8e-737ed60ed725
www.proofpoint.com/ Name: driftt_aid
Value: b7d5230e-ca40-43f3-bc8e-737ed60ed725
.zoominfo.com/ Name: __cf_bm
Value: V65X9Y9Xu1V4jXk6EIkYyxapaOcGO3zM0wYTpG19Ets-1715846244-1.0.1.1-JK300jU.1QL4NNOGYFfqsxbaNao.sx8oGOchVXCGMQER3DVauKC9P3QdMAHDfRqE5vk24zDLi_..SrLxwRDeCw
.zoominfo.com/ Name: _cfuvid
Value: nZ5_QjPmM7olK4xqVysBavwQWRQV_mII9Fnf2esGSE4-1715846244946-0.0.1.1-604800000

83 Console Messages

Source Level URL
Text
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering(Line 1017)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering(Line 1017)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security error URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X(Line 746)
Message:
Refused to load the script 'https://client-registry.mutinycdn.com/personalize/client/d454424c4514a20a.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering(Line 1017)
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://connect.facebook.net/signals/config/143852102935619?v=2.9.156&r=stable&domain=www.proofpoint.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 107)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering(Line 1042)
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering(Line 1042)
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering(Line 1042)
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://js.driftt.com/include/1715846400000/5dfsgn7m2kst.js
Message:
The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com *; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com *; report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10031399.fls.doubleclick.net
309-rhv-619.mktoresp.com
4788165.fls.doubleclick.net
app-abj.marketo.com
attr.ml-api.io
b.6sc.co
bat.bing.com
buttons-config.sharethis.com
c.6sc.co
client-registry.mutinycdn.com
connect.facebook.net
dev.visualwebsiteoptimizer.com
epsilon.6sense.com
fonts.googleapis.com
geoip-js.com
googleads.g.doubleclick.net
ibc-flow.techtarget.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.zi-scripts.com
l.sharethis.com
munchkin.marketo.net
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.ml-attr.com
secure.adnxs.com
snap.licdn.com
stats.g.doubleclick.net
tags.srv.stackadapt.com
tracking.g2crowd.com
trk.techtarget.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.proofpoint.com
client-registry.mutinycdn.com
104.102.141.31
104.16.92.80
104.16.95.80
13.107.42.14
13.248.142.121
142.250.184.198
142.250.186.162
172.64.150.44
18.245.86.77
18.245.86.87
192.28.144.124
2.19.176.179
2001:4860:4802:34::36
2600:9000:2057:ac00:c:abe:f440:93a1
2600:9000:206f:fe00:5:7a81:86c0:93a1
2600:9000:2156:5e00:1d:85c3:6640:93a1
2606:4700:4400::6812:216e
2606:4700:4400::6812:2b1f
2606:4700:4400::ac40:973c
2606:4700::6810:762b
2620:1ec:21::14
2620:1ec:c11::237
2a00:1450:4001:806::200e
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2002
2a00:1450:4001:830::2004
2a00:1450:4001:831::2008
2a00:1450:400c:c0a::9c
2a02:26f0:2100::58dd:c512
2a02:26f0:3500:16::215:148d
2a02:e980:107::cf
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
3.160.150.46
34.111.208.231
34.96.102.137
35.156.113.21
35.157.234.167
37.252.171.53
68.67.153.60
006cdaab6ca61d79b8fecd9bb8a71fc9cf21e292d85b9d34d8a15ccce62c5f27
00a028b6540a3f5309fccc8c5c6d5d5e1da884807e21931d907f29f7247ea734
013ebc8682bafe775a56f93904cff8456974906327dad3524e2ab2fe0c0df700
0660976790bb5eed64d9617a793a7fcd80b6180f6793c9a68162d0ea12114f2a
08877ec4f8e5936e2d57bf3c510f03d7cfd4e081c206c99d97776b820f69ae62
0b291571122aec79a4f86f9e799ff7707ee3dc914413f425feede8259612ecc4
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0cfeab03a9be2423c0e828558c5f0b05235ced0efc8810fd90f0fc2ec00ce931
110990cb06ddfd8a81dca4c88cbbf125fb2891dc8c19fc809385b31281f7424a
1519ceaa67bcd32243176aa59028ac713011d3fdb6e9ef4dffa70cce31ae8cf9
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
1a6a1d377a58ebff94ff1104a484950dd0147cdae7089281dd85e2dc50adcae7
1efc356399045f3789863eafdb41484a9000a91b1d5eafdfe8237bb33a3374a2
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
280f323a35d8fd5cb49e44ea4d9847641b60beb3a21ea34b9116f0c7cfe85003
2b72026eaaae017cb9535ad20f82d00bc0ce390c76fbf5268e4708f9bf5e9bf8
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2fcc89a225150f8d1c9c173c1eeb64f41c02c90932fd111203ac65ca5e1594f1
3d827d05f0c1502d3b245e544611619ddb4d0eec78f55940594ae531e4f62cfc
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
4160094e8e7a55a3dd60c62de930a81375ddce09c11dc6d7b28332da6dbbdf14
480dfc4f346103ef7f50a60ef2462bc7ef967a06ee6ed20c6dcb50a6ef48d66e
49d8c0046653590d7a41df2d1b8c1a7cbef5cb5fac7efdeceeac710ce6237078
4ae79f6079013e0b6e62b871e558a573823eed1be52852634e13d3bee5663380
4b274cd219e6f9e664781b8997843f0881f8911ffbc922349ec4c7b35d50ed78
4d6d961566d4d8147e52004898f04998d55bf475203c8aff3c9de126926d8c8c
4fffc9e433325201efe66c3a32d653b1c44cd909996cf29ed80ab991b6964b14
50a656cd1682bc2ac25d8af9262a2ce1c8848624629366a30c4cd95e086c2648
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
55bda2f21018d051f95b3aebea318bd719370a3a870245f92dd9c3e7d6348a59
55c61b6a15a6e2094e6e4a32b201ca57af2b03b99d1c812c0fef04bae3dbb9f3
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5680e67bec883a7cc47635705afdaa0d28ad681a1bec515983784fe6c002356b
5739cc9f6968228ab43635534881c198f400f265a29a8fe9519f607ac5b4f214
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5f3083b731588016304b0ac105b66985b8ffc9d2c7a2e627f0435da5e86a4648
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
6312cd49d1d0b91d2aa283cba2ad0365fc697b3e7fc5b34f6e749ba646b4ec31
6411c1a319b14238b941f27f2db724c769158d7d3a84814dbb46255e14129f4e
6450691706460a0ed12542c899ec8108a2856abefd157b9ef298661ebb5ab506
64ac610477f4c2a19d7ade073fef3eccaa7db99efa5ff86733fb44c33c55226a
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6cb9dea6bff9a1a74e1a7cb70542259e72698c2afddbaa921ccfe9391670c55b
72a15930d7a4561b6af10b65f0e28f3956ef3001404e6fa5ed15ae795567befc
737324c6a9ca813b87b9a4a164306097cbcb07bc96b74db797f9cd8cee9fc31a
751b1a09760d9c50041b5f070968f1ae898dfb4f6f89b86d0bfa6526d0dc89ae
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed
7722334fb6c6245e16012b8507cca1836cd7dc3f6e7cb1c8ba11f30f2fe09b24
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7e7fd9f1e6fd2387dc2a5bb83cb72a1c44206347ad8ffde69bcab829cf88b1ff
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
88dfd6fc2bf5814e1fd826b25417ab4e0f11354c5adf2fa49dad6d97e444ebb6
899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9
8fd5dcb3427fad9f1304d5a1eafd0f9db5aafdf9eabe50bb1e5c2a16fc521efe
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
989ad4866106466cdfb29b515b0271c7f568eb08f5a248e4ad7f77b0b4bdb784
98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f
9afc67691749451c5fc73c4f1f0964d8937508b7446a9133ea6ebf731e7bd520
9c1b1066c42f920ce30aee11e0645fc48f66f13f828e31865b34abe54d6dd4e0
a54fee5912de81021ec64a51dc08b3781b38be49e178936b134ff777e23185ae
a648ce121471a1df44d51ddf4ef7e63c730ca77c1c59b0002e01004c4473f3bd
a7de65ae8dbd3767d98f475502d97732a81ceecbc6f1b2f52f03e457207753d2
aa44e3c804607a8a17c2e9597537350b4e425c1708a1c7c6fc50a28dba1fd488
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b5ef7dd34cf17eb441a01a651d089e520dff86ae2337ff95ee079f46a394880a
b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8
bd5584dd3ce86c6fc33cf17cc82ee828026eaa7c7b7ac0699db83efade55f06b
c085f071c91cba3d92b143fa274473c70d13d5ce516150ae794d3ffba17791b5
c3666e420f1e9ea50d544484f433bb0613fe24e0891935549f12ab937e379440
c3ea3a972768896d2a84d6eb36d3f5919478ad9c091477c22a5362eb6d53aee4
c45c82a27f734de8594f06f5e4e0706d5452131d8cbb8be42e18233af4b374e6
c8eb65b82df3fc24b2b475bdd155953405c4ac91ecf0b5fa58d92b24f9fd058b
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
ce89affdf3ca1fc04cc0ddaed91dfaae11a37561e3fec2dd1e5ea3969b0b575f
d397a80cd56a7cc222adee293dd1fe489aecc3b5887c7fdc568c1b6eebafe6e9
d756aa94bf52a495078ecadd896d7deec037433e2df5609d7bd0d5388f084997
d790432627c2bcb0358551fe8035b2a90757cd31a6eccf189f2f0c809e89ad80
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
daad388c25a3e461319286cb929ca60c6d9f5678605d604e8817e10e892327b2
dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0d9ca9316294d8c98704da12c55856a2bc837adf42106bb0b7ab89f77115540
e2a193fa1b1801dcdddf024a250b04b496f5e36e4324a8de73948e6421ff5865
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0
e9f9158aa766d8d7fb6bfd1d0bf9ab1f95cfe61bea39e105028d569fb4234295
ece2d0c67a92dd2e9092416cd1c60151504e8f7eed717af3b152420c3684a3f5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a