www.threatfabric.com Open in urlscan Pro
199.60.103.254 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Submission: On August 07 via api (August 7th 2024, 6:17:32 pm UTC) from US — Scanned from CA

Summary HTTP 67 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 20 IPs in 2 countries across 20 domains to perform 67 HTTP transactions. The main IP is 199.60.103.254, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.threatfabric.com.
TLS certificate: Issued by WE1 on July 8th 2024. Valid for: 3 months.

This is the only time www.threatfabric.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	199.60.103.254 199.60.103.254	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
6	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.89.62 104.18.89.62	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:400d:c09::61	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:ad5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8dd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:1408:ec0... 2600:1408:ec00:1e::1735:23ec	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 6	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:80ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6812:17b7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:6ffe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2620:1ec:50::12 2620:1ec:50::12	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2607:f8b0:400... 2607:f8b0:400d:c07::5f	15169 (GOOGLE) (GOOGLE)
2	104.18.80.204 104.18.80.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.19.159.252 104.19.159.252	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:400d:c01::66	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c07::5e	15169 (GOOGLE) (GOOGLE)
67	20

28 199.60.103.254 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.threatfabric.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.89.62 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c09::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:ad5b (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8dd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:ec00:1e::1735:23ec (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:7574 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:80ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:17b7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6ffe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:50::12 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c07::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.80.204 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.159.252 (None, )

ASN13335 (CLOUDFLARENET, US)

threatfabric-6701575.hs-sites.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c01::66 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c07::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	threatfabric.com www.threatfabric.com	2 MB
6	hubspot.com 2 redirects js.hubspot.com — Cisco Umbrella Rank: 8139 app.hubspot.com — Cisco Umbrella Rank: 10634 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 8074 track.hubspot.com — Cisco Umbrella Rank: 5359 static.hubspot.com	29 KB
6	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	65 KB
4	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 5067	28 KB
3	linkedin.com platform.linkedin.com Failed px.ads.linkedin.com — Cisco Umbrella Rank: 669 Failed px4.ads.linkedin.com — Cisco Umbrella Rank: 7330	2 KB
2	gstatic.com fonts.gstatic.com	46 KB
2	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 8524	1 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 9601 forms.hscollectedforms.net — Cisco Umbrella Rank: 9837	25 KB
2	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 12087	6 KB
2	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 20878	4 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 104
1	hs-sites.com threatfabric-6701575.hs-sites.com
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	865 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 7189	4 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 5135	25 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1884	14 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 5414	1 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	94 KB
0	twitter.com Failed platform.twitter.com Failed
0	facebook.net Failed connect.facebook.net Failed
67	20

	Domain	Requested by
28	www.threatfabric.com	www.threatfabric.com
6	cdnjs.cloudflare.com	www.threatfabric.com
4	js.hs-banner.com	www.threatfabric.com js.hs-banner.com
2	fonts.gstatic.com	fonts.googleapis.com
2	perf-na1.hsforms.com	www.threatfabric.com
2	cta-service-cms2.hubspot.com	1 redirects js.hubspot.com
2	px.ads.linkedin.com	snap.licdn.com www.threatfabric.com
2	static.hsappstatic.net	www.threatfabric.com
2	cdn2.hubspot.net	www.threatfabric.com
1	static.hubspot.com	1 redirects
1	track.hubspot.com
1	www.google-analytics.com	www.googletagmanager.com
1	threatfabric-6701575.hs-sites.com	js.hubspot.com
1	fonts.googleapis.com	js.hs-banner.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	px4.ads.linkedin.com	www.threatfabric.com
1	app.hubspot.com	www.threatfabric.com
1	js.hscollectedforms.net	www.threatfabric.com
1	js.hsadspixel.net	www.threatfabric.com
1	js.hubspot.com	www.threatfabric.com
1	js.hs-analytics.net	www.threatfabric.com
1	snap.licdn.com	www.threatfabric.com
1	js.hs-scripts.com	www.threatfabric.com
1	www.googletagmanager.com	www.threatfabric.com
0	platform.twitter.com Failed	www.threatfabric.com
0	connect.facebook.net Failed	www.threatfabric.com
0	platform.linkedin.com Failed	www.threatfabric.com
67	27

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
twitter.com

Subject Issuer	Validity	Valid
www.threatfabric.com WE1	`2024-07-08` - `2024-10-06`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2024-03-06` - `2024-12-31`	10 months	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
hsappstatic.net E5	`2024-07-06` - `2024-10-04`	3 months	crt.sh
hs-scripts.com WE1	`2024-07-29` - `2024-10-27`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
hs-analytics.net WE1	`2024-06-11` - `2024-09-09`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hsadspixel.net E6	`2024-06-14` - `2024-09-12`	3 months	crt.sh
hs-banner.com WE1	`2024-07-27` - `2024-10-25`	3 months	crt.sh
hscollectedforms.net WE1	`2024-07-25` - `2024-10-23`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-07-01` - `2025-01-01`	6 months	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
hsforms.com WE1	`2024-06-14` - `2024-09-12`	3 months	crt.sh
hs-sites.com Cloudflare Inc ECC CA-3	`2024-03-10` - `2024-12-31`	10 months	crt.sh
*.gstatic.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Frame ID: A8E5EE1D79156E872B32A244B1AE4ED0
Requests: 65 HTTP requests in this frame

Frame: https://threatfabric-6701575.hs-sites.com/hs-web-interactive-6701575-139494617102
Frame ID: 8493F76E4B8EC499930002A44D24737E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chameleon is now targeting employees: Masquerading as a CRM app

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

67
Requests

90 %
HTTPS

74 %
IPv6

20
Domains

27
Subdomains

20
IPs

2
Countries

2154 kB
Transfer

3419 kB
Size

10
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/company/threatfabric
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/threatfabric
Title: Twitter

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723054646286&li_adsId=de4fec86-3207-46ce-9b83-e8d704454c67&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723054646286&li_adsId=de4fec86-3207-46ce-9b83-e8d704454c67&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&e_ipv6=AQIWQBAq6wKqYAAAAZEuD2TSULd7CA3e6x8jaH0blOIHR9wLvcJKvgv-rKvuzG2NynPidNdD

Request Chain 65

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=266333855879&containerType=SLIDE_IN&portalId=6701575&audienceId=null&campaignId=7436f6e2-b46a-4ea1-9c6e-4aa7d59b7348&isLoaded=true&pageUrl=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&pageTitle=Chameleon+is+now+targeting+employees%3A+Masquerading+as+a+CRM+app&userAgent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F127.0.0.0+Safari%2F537.36&hutk=04a16e57ce52a861691ebdd692d582e0&hssc=167810878.1.1723054647373&hstc=167810878.04a16e57ce52a861691ebdd692d582e0.1723054647373.1723054647373.1723054647373.1&pageId=174294865261&analyticsPageId=174294865261&hsfp=2486248749&canonicalUrl=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&contentType=blog-post HTTP 307
https://static.hubspot.com/img/trackers/blank001.gif HTTP 301
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

67 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request chameleon-is-now-targeting-employees-masquerading-as-crm-app Show response
www.threatfabric.com/blogs/ 40 KB
13 KB 570ms
275ms Document
text/html 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0015f2823b39f602f306802a48c26ed9c8d03e1caf9a7342a9cf2ae07d74898c

Security Headers

Name

Value

Content-Security-Policy

default-src 'self' static.hsappstatic.net; script-src 'self' 'unsafe-inline' *.hubspot.com cdnjs.cloudflare.com *.hubspot.net *.hs-scripts.com *.hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net *.hs-banner.com *.hs-analytics.net *.hsadspixel.net js.hscta.net *.hscollectedforms.net *.hsleadflows.net *.hsforms.com *.hsforms.net feedback.hubapi.com *.usemessages.com snap.licdn.com *.doubleclick.net; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com *.hubspot.net static.hsappstatic.net fonts.googleapis.com; img-src 'self' data: *.hubspot.com *.hubspot.net static.hsappstatic.net *.hsforms.com *.hsforms.net js.hscta.net *.linkedin.com www.google.com maps.gstatic.com maps.googleapis.com; font-src 'self' cdnjs.cloudflare.com *.hs-banner.com fonts.gstatic.com; connect-src 'self' *.hubspot.com *.hubapi.com *.hs-banner.com *.hscollectedforms.net *.hsforms.com js.hscta.net *.google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net; child-src 'self' *.hsforms.com; frame-src 'self' *.hubspot.com *.hubspot.net *.hs-sites.com *.hsforms.com *.hsforms.net play.hubspotvideo.com www.google.com www.youtube.com; frame-ancestors 'self'; upgrade-insecure-requests

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-ray: 8af9436cab85aaf8-YYZ
content-encoding: br
content-security-policy: default-src 'self' static.hsappstatic.net; script-src 'self' 'unsafe-inline' *.hubspot.com cdnjs.cloudflare.com *.hubspot.net *.hs-scripts.com *.hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net *.hs-banner.com *.hs-analytics.net *.hsadspixel.net js.hscta.net *.hscollectedforms.net *.hsleadflows.net *.hsforms.com *.hsforms.net feedback.hubapi.com *.usemessages.com snap.licdn.com *.doubleclick.net; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com *.hubspot.net static.hsappstatic.net fonts.googleapis.com; img-src 'self' data: *.hubspot.com *.hubspot.net static.hsappstatic.net *.hsforms.com *.hsforms.net js.hscta.net *.linkedin.com www.google.com maps.gstatic.com maps.googleapis.com; font-src 'self' cdnjs.cloudflare.com *.hs-banner.com fonts.gstatic.com; connect-src 'self' *.hubspot.com *.hubapi.com *.hs-banner.com *.hscollectedforms.net *.hsforms.com js.hscta.net *.google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net; child-src 'self' *.hsforms.com; frame-src 'self' *.hubspot.com *.hubspot.net *.hs-sites.com *.hsforms.com *.hsforms.net play.hubspotvideo.com www.google.com www.youtube.com; frame-ancestors 'self'; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 07 Aug 2024 18:17:25 GMT
edge-cache-tag: CT-103904753728,CT-104229759503,CT-122018350512,CT-174294865261,CG-101307487134,CG-6701575,P-6701575,CW-101038360946,CW-101039839309,CW-102233451816,CW-102407694414,E-100565705870,E-100565738928,E-100565906251,E-100565938482,E-100565944445,E-100566507657,E-101038360928,E-101040014386,E-101040140217,E-101294760764,E-101294760784,E-101312928029,MENU-101041626940,MENU-110583778143,PGS-ALL,SW-2,B-101307487134,GC-101041468817,GC-101042470934,GC-101758895261,GC-101962663308,TS-101040118157
etag: W/"401a0cf761970c5a7cfc2ca2ed0eced6"
last-modified: Wed, 07 Aug 2024 00:17:40 GMT
link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c3HA6c25Pvc7ebfyHRnrKwlLxMacwiXIeJcl2cvHhNTHCnL0Up1zTVGSrsFRpdKw55vfGcB5iikmu1Eh2LhxTnfVfuf9HzPB99UX4z7HxGHk%2Fmel%2BNXZN5OZ4okNboBf2p4RR0Ip"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation-rules?url=www.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-hs-cache-config: BrowserCache-5s-EdgeCache-180s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: HIT
x-hs-content-id: 174294865261
x-hs-hub-id: 6701575
x-hs-prerendered: two-phase;Wed, 07 Aug 2024 00:17:39 GMT

GET
H3 204 speculation-rules
www.threatfabric.com/cdn-cgi/ 0
399 B 193ms
192ms Other
application/speculationrules+json 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatfabric.com/cdn-cgi/speculation-rules?url=www.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eCzGL3o7j8BqdjhFXHc06SNDb346iXO%2BckuA8arvT86HZnD3Kw3py0iAInpF5h9k4gA6JBN3ZfbpQ%2BL7B9U3zo8TiXi9dnqVgZ5J0FrGvAMOYqlLzRRQ%2BaHmG4A8Xlai7BpLeFQn"}],"group":"cf-nel","max_age":604800}
content-type: application/speculationrules+json
cf-ray: 8af9436e6ce1aaf8-YYZ
alt-svc: h3=":443"; ma=86400

GET
H3 200 project.js Show response
www.threatfabric.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 65ms
62ms Script
application/javascript 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: gzip
via: 1.1 8f20ff24dd415d652c896cb797feb54e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 13911965
x-amz-cf-pop: YUL62-P1
x-amz-server-side-encryption: AES256
content-security-policy: upgrade-insecure-requests
x-cache: Miss from cloudfront
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
server: cloudflare
etag: W/"61ca66de658cab9587e4636894680d5d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XsCZ%2FxP%2FcXZ7pOGjWoY7PjcesX0RnGSVievaIW%2FQ%2FFtvHXG6SN%2B0F9ISMuhL58%2BYHOy8SIi2LdhiNmEMiFCurg4T2jthj8foS2xFQ1quHIQRct4BSnOEZ2b5BSF9GDLXoMA6FnoB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8af9436e7ceaaaf8-YYZ
x-amz-cf-id: rj4GCUtIGxdijvMpQnQ9llcdO2a13AZMNLGn8BVHpymZRGg36kEVIg==
expires: Thu, 07 Aug 2025 18:17:25 GMT

GET
H3 200 100.woff2
www.threatfabric.com/_hcms/googlefonts/Kanit/ 25 KB
26 KB 82ms
70ms Font
font/woff2 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/_hcms/googlefonts/Kanit/100.woff2

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa7fe4fd0aef1b94a3910f43b99060d1fcf2b12302726c4f52146ca1f613e516

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 2080aae7ace369c71819923852e1b17e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3030
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256
x-amz-request-id: T9NCXCNY0F62FHB0
x-cache: RefreshHit from cloudfront
x-amz-version-id: Ex_PSmZfVx9KiCmfDr58lb1Qor1iW7rw
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
alt-svc: h3=":443"; ma=86400
content-length: 25596
x-amz-id-2: i0KSa87f5DK7JUrNPRjD6KwnTrgefZ8IPTyonIW229nKCDBTonKIs3Kkhddq/w0K1nLRB1vME6Y=
last-modified: Tue, 12 Sep 2023 20:06:52 GMT
server: cloudflare
etag: "bd6ef5dfe3fb409deb99fd2dfa07649a"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ujrEAj%2BtiREjFiYXFJ%2FBRvNY7WHyuURtOFsTKWE8OEPrNhXA7XNxurFWEEySMNscEG2HLFsJmoHVwt9wRuZnUXUxbxzQS17iLh2RtB%2FQuXlABXmCry%2FFPej28%2B95E27X%2FiS9BYNi"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8af9436e8cf5aaf8-YYZ
x-amz-cf-id: fDiFK099ub9EPSNG9jKZWjwCjDcF09uSHk_It2yeXfI9moGQ8GJalg==
expires: Wed, 21 Aug 2024 18:17:25 GMT

GET
H3 200 regular.woff2
www.threatfabric.com/_hcms/googlefonts/Kanit/ 26 KB
27 KB 86ms
71ms Font
font/woff2 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/_hcms/googlefonts/Kanit/regular.woff2

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b023c3b26ca69356ad0aa6b6296d5e6a337ec10ca1f8275483437202a03c381c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 5e2f1ed3ba0ab1e08304bb3d134360de.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3029
x-amz-cf-pop: YTO50-P2
x-amz-server-side-encryption: AES256
x-amz-request-id: CD9967RWZW8ZWM9W
x-cache: RefreshHit from cloudfront
x-amz-version-id: R8IBymNhr0oWzfN7i1miwZxu391_6F8B
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
alt-svc: h3=":443"; ma=86400
content-length: 26352
x-amz-id-2: Q0Y7LHTyhiJbTvE8od7gq0sjvytVQP5ROo1nOqTFIp7OQ8XermigCLF9iPsIcnI6CgmtruArywk=
last-modified: Tue, 12 Sep 2023 20:06:55 GMT
server: cloudflare
etag: "d4d741d6401097b23f04835fd935ddb4"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KFotVBlHkfzbqz4grJk%2BVV3MAK5oKQuJfmuPZmaSxlrEKMb7UBp1r0Qyj2eTRGqIXabNI7KEO0zGoajMrfmrwM05ygPxsdxlJADGCDszfdLEjAoBkCeyhwvG3dfEo%2FM15zYHbQ7J"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8af9436e8cfcaaf8-YYZ
x-amz-cf-id: Vji9gZa9XPZLIjPD27UA7M5mXbzXGnpW9JMrKQDdiIhUlZwImHssbA==
expires: Wed, 21 Aug 2024 18:17:25 GMT

GET
H3 200 200.woff2
www.threatfabric.com/_hcms/googlefonts/Kanit/ 26 KB
27 KB 101ms
86ms Font
font/woff2 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/_hcms/googlefonts/Kanit/200.woff2

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0adb227efa2074c6ae2b5e686cf4d1949a6edfc05bd56fa81e34c9a2c69fb50a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 20b1477855fc653cbeac2a93871404c4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3029
x-amz-cf-pop: ORD58-P2
x-amz-server-side-encryption: AES256
x-amz-request-id: 9G2C8W0ED12J6Q8H
x-cache: RefreshHit from cloudfront
x-amz-version-id: .Y4_sica4_7w7dZrWB8zUo33LkbHGzIv
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
alt-svc: h3=":443"; ma=86400
content-length: 26228
x-amz-id-2: CzXP+juMz4TfXClqL6NN63Pn9zeQTlFtpn76M2GBxSv6UIrhggci7fW/vFqXiBu3rxlm7q5cpdY=
last-modified: Tue, 12 Sep 2023 20:07:00 GMT
server: cloudflare
etag: "a3acdea9b09d1ffdf16868a322d89c6c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fOnB3syu4i815FFCeb4rP36EKcWRTtaAIVh8%2BkOtyRAin62etI0gYaDVIBDd3r1GHVxsR680%2BsJaoOdbOLWYyq5h%2FQvJBlirmleigpjja34JhLva9Dh4RSUfcPuad9vjKUSXdoa1"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8af9436e8d00aaf8-YYZ
x-amz-cf-id: F8fZSIPb_DBgORVwtV87QxUyxEsBX-V-a00CFMILolwoe-ruVog1BQ==
expires: Wed, 21 Aug 2024 18:17:25 GMT

GET
H3 200 main.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565938482/1712566991562/Threatfabric_Hatch/css/ 474 KB
97 KB 170ms
155ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565938482/1712566991562/Threatfabric_Hatch/css/main.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c564955dad803a6139bc52a7d05b9fcceeec494e5aced6e9db08d20d8ff076ee

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 3030
x-amz-request-id: MBJQJTWQTVFEXMCQ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"859ddc6bb854f252af8367f7f2788fef"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566993905
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-amz-version-id: uV201nZDhB1C0jUSHWbSv3F_kObyKinu
x-cache: Miss from cloudfront
x-hubspot-correlation-id: bed7a0a4-bf65-440d-900c-abaf74cefdc8
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 254
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Jlo/o5k5T8mrhgRsd71C6luaYTcO+yMarggw4wbkSCj76mwaehRXN2u9dCM0i2K3HWJ+vh7b2e0=
x-evy-trace-route-configuration: listener_https/all
x-request-id: bed7a0a4-bf65-440d-900c-abaf74cefdc8
last-modified: Mon, 08 Apr 2024 09:03:14 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sjH9IPndjR43IkKyhcbXt99Gd94MF7GldYogNTnvbbTf7FEfXTZVrLZZPfJtOChFxDDnjwuz7FZn5aRBedltcoRiVWUU%2FShRwkly5OUKE0zd2XmClWQdFkxf8w856fcFJOWyKk3L"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-lrfms
access-control-allow-credentials: false
cf-ray: 8af9436e8d02aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: p9sR2tYUBTOSyAhF3LO2lx-60L-I4xHTJJnn6eI92G0cEO60V-Tx6A==

GET
H3 200 child.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/ 18 KB
6 KB 82ms
67ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/child.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e9c6e361ad47dcbdc817cde52918b29e424ed462fbbcef27ae9d2c826e7ee63

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 3030
x-amz-request-id: DMCEARY4MR4EJB0R
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"5a5a650f203fc94d0365fea983d98822"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1714390879936
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
via: 1.1 3c324ded5bb9b770378ef373690c8a34.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-amz-version-id: 9MNBXojoOMXTDBn_r9zZsB4hER1sLFIj
x-cache: Miss from cloudfront
x-hubspot-correlation-id: b9ecf4d4-dd15-4ace-a72a-e98a849bf5be
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 244
alt-svc: h3=":443"; ma=86400
x-amz-id-2: zXoP5BKb+lmm0EnwM3TNkTXglxLfrq6mLYkT70LJU7X5JD9Oa6Id123h6fEIb4JBgzp8lsOScpI=
x-evy-trace-route-configuration: listener_https/all
x-request-id: b9ecf4d4-dd15-4ace-a72a-e98a849bf5be
last-modified: Mon, 29 Apr 2024 11:41:20 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fVu5Mdj%2FpMjs8sbGueQP9fzjthBitzQ4HtudxgMtrjKtR3rtajsGpCQltZ%2F0sHtQAaiePmZkKk37hVdWQvh9WDX77%2BPMe0zw2XHtNTQkY9T%2BodpC2i%2BdjRwo3ePru2GHmdxogbz3"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-5zvjq
access-control-allow-credentials: false
cf-ray: 8af9436e8d04aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: NzOmzcLYAGOqIdkBpjjabkbMZN3LktNInI2VJiqVm_Hr09zzHdJdzw==

GET
H3 200 icons.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760764/1688634016207/Threatfabric_Hatch/css/ 8 KB
4 KB 264ms
249ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760764/1688634016207/Threatfabric_Hatch/css/icons.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b754a50214c3af13ad5b80267b36a52a379030f4cdf28ea62bdc23121fb63963

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 3030
x-amz-request-id: 2JXPNVMFWC6JRAW4
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"f485b62b545a7fcece25c8883be79caa"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634016207
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-amz-version-id: 5nj8DyG_fzY9UD_XVa9rI2VVLKA_WOmB
x-cache: Miss from cloudfront
x-hubspot-correlation-id: 266e6329-0aa7-4945-915a-0b45cfd8c566
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 165
alt-svc: h3=":443"; ma=86400
x-amz-id-2: NvtAovs96NzZ5WQ58uwGpiBpbAN03tBUCgeJhi9F2fq6aEvqigLaXYrL9eRNm1RrIkiaVf7VY5g=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 266e6329-0aa7-4945-915a-0b45cfd8c566
last-modified: Thu, 06 Jul 2023 09:00:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G5AbRvv7lwUJWUdfa7YFXqvEtgCDf67UzWdW4q6LNAC8lTtPrgfI2vKLq26tFcKFZANIsqC61ELVxRy1pYmtd1tKctjwvYUFaD2F9mpTyrwiDaolBSuea8YxwQP%2FKzyNFUg%2FpVkM"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-8czpn
access-control-allow-credentials: false
cf-ray: 8af9436e8d06aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: fjC8M4qR5Wn9S2O5fc4jOFlXaQcvVq9J3EH_F6uVm9MTh6GfCbe1aQ==

GET
H3 200 nucleo.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760784/1688634017698/Threatfabric_Hatch/css/ 2 KB
2 KB 276ms
261ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760784/1688634017698/Threatfabric_Hatch/css/nucleo.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

74c17452683150ad0f623fdd9a849ba85d73fb9d221cebe9aa11db52969dbe23

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 3030
x-amz-request-id: 0R21K9PZ4E9F2C9E
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"49397c87250109646a57314c716d8517"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634018325
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
via: 1.1 d1cde188ada6755fe03b8541b71fce4a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-amz-version-id: izNRL5rIQmPgjsTIc9ETzUXSIAYDVuDR
x-cache: Miss from cloudfront
x-hubspot-correlation-id: 16445a20-2b35-4bc5-ba3c-30ff88309b1a
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 204
alt-svc: h3=":443"; ma=86400
x-amz-id-2: jOBwtbPOZkas81P4eEGUtl5nqOkLTngSHfqgxePzue2DnwfpUA7TK5CgxOlg8vLyrNwmNFo5pg8=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 16445a20-2b35-4bc5-ba3c-30ff88309b1a
last-modified: Thu, 06 Jul 2023 09:00:19 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dOfpGBS5%2F9YQUFZSSizkgAxeUzuoboWwb1S1AHo2x5AOQD4wCS%2Bcxndt2w2LGv%2BmiS44EDaybZTD3Foeu%2FhzBawazpx%2Bs4DeyqR9Tcay6BwS1etbvdnrG%2BF43Se%2BkFp4BnMCJQX8"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-8czpn
access-control-allow-credentials: false
cf-ray: 8af9436e8d07aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: bWCfVXQ5y2tOaKh22sTr7Uk3LVS0X0NQtsS_MbzIuSx51KuFqvx7uQ==

GET
H3 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/ 58 KB
11 KB 113ms
40ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/all.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 39663
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10491
last-modified: Mon, 05 Oct 2020 17:43:59 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f7b5b5f-e7d0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=deP96VItrmoo2lhXSUyRP5JNKR%2BEKoer336hNVgaFk5NnFqrp%2Bgoe8sbRoCLn2NCjzUdFzr45KXdag%2BQ%2FvGiyJt4g%2BUPkUm6BT9xAbXyJyrjL3MzYTGj0Fe1lvRJwRunkksIsP7%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8af9436ee8feac69-YYZ
expires: Mon, 28 Jul 2025 18:17:25 GMT

GET
H3 200 module_101038360946_Header.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101038360946/1688634802882/ 365 B
2 KB 277ms
263ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101038360946/1688634802882/module_101038360946_Header.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5172f440714da51e243a13e0f93911405618326b2013313b682caa428c47e6ef

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3030
x-amz-request-id: 93TEYA5ATM97AWM0
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"9256add48c317a196c6723f7f46739fd"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634802882
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: gVyaXIU3JxB7cR9Hx9mqhXufUagRPpyd
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: c551597b-5151-407c-b9a2-f2d5e3d75b1e
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 204
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 8zXfWZVYEo3/F+zdW/1U/TjTSHU9Jk2nmjqg467P4pKQKK/RYvhNePAdiKxcmz3Ghr6+ujrWtLU=
x-evy-trace-route-configuration: listener_https/all
x-request-id: c551597b-5151-407c-b9a2-f2d5e3d75b1e
last-modified: Thu, 06 Jul 2023 09:13:23 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Pke8AhDm0MrOXNMUFvQwwgvIU1puJBpX04NObPTbkpPJ3t405900k2IJFtBl5jq4yyhfY3aYVbklWccpl6yfEvjFoDvM1KYU%2BEHxa6fxOWPCXiw6tKpiM4t2fae9dvPl1tl2vXV"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-fq9rh
access-control-allow-credentials: false
cf-ray: 8af9436e8d08aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: eYfmBRav4CvpZYQOW5o_mbTLO0H1rIaeOs0nzvrIPPPXSD329UJokQ==

GET
H3 200 module_-2712622_Site_Search_Input.min.css
cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869177377/ 612 B
1 KB 135ms
57ms Stylesheet
text/css 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869177377/module_-2712622_Site_Search_Input.min.css
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 401925a1114f7003121630392768d35516be54a4028f01024528aeae99a45a56

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
age: 185393
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"c708989561e0cdbfcf996d1b7f47482c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1722869177377
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 526081b8-9088-4418-94c6-fb414f0fe114
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 155
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 526081b8-9088-4418-94c6-fb414f0fe114
last-modified: Mon, 05 Aug 2024 14:46:18 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g49Ov7hZiFk6nhgLQ57tZIixO5Bkm8u9ehl6LajUsQBOFTIuGp3SwhmXns0%2BQXAMU%2F92gusVzDff%2BYSfN1MuH1MKc2q4mWFVAXXnYO0sXu6Efb7tG282FMOw3BvLb7gx4D8%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-dwjx9
cf-ray: 8af9436efa36abab-YYZ

GET
H3 200 module_102233451816_Blog_Post_01_-_Banner.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/102233451816/1694502536285/ 208 B
2 KB 283ms
269ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/102233451816/1694502536285/module_102233451816_Blog_Post_01_-_Banner.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6685b4f71edb4ae81b8a710e36f8c794c3e731feeb17614e476daf056b06a824

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3030
x-amz-request-id: FREQ9GFMEDJDQ7VY
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"835a1aea3731b5d0aa01d0cad90f4c2f"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1694502536285
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ssRnpRBke62diMBB.QBnNR1bBVg.nduX
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 1dc6751d-e308-48b6-85b8-cc9899593234
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 234
alt-svc: h3=":443"; ma=86400
x-amz-id-2: h4kgdu8IifsNWZSI1dtSgZ6/W/WEfvXb4z46RM8800P9pOGwOgpI4fWW387XQYMEVjshzJgTLbS3mMK1XbSrEr/S9hCD1mS8O4D58KrKm10=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1dc6751d-e308-48b6-85b8-cc9899593234
last-modified: Tue, 12 Sep 2023 07:08:57 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vkCMGUhLkTTi3OHtp%2B5bUX9TYnqkd2U%2F%2FCqnNE3BMfYNNwrmhzwcR7r1KjGij8wZrX38r9AgBBkurVwj1X%2FTd7vT%2FdrPFF4PJk79StA8q5BqdfJ3dekG18ankvV89s%2FVCAl1YgPD"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-dlv5r
access-control-allow-credentials: false
cf-ray: 8af9436e8d09aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: xYGEr1KZzpkkbInLQE5GIznCac9TOLb5KegpxdelApcmmWzoCA3e7g==

GET
H3 200 module_102407694414_Blog_Post_01_-_CTA.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/1718609428269/ 749 B
2 KB 276ms
270ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/1718609428269/module_102407694414_Blog_Post_01_-_CTA.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a924c55af6e42515871fdd850703bea91aedd280d30febc3ddc9f674df234785

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3030
x-amz-request-id: 08PTX44KA0PZ2H6F
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"e2815258c7a6f2ee41cbfe804e58e066"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1718609428269
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 be4fef3f6c1b2c76e0341ff49a27ce40.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: TqETGXjPmLIPWPl8IqOMcPpc8lXb7CNv
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: d9c7f761-5351-49eb-ae6f-c36a53c6e8bb
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 172
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 88q6TMOL/swA4ulids5YckyKbZUvv6RVqiNzi8tJf83wK4ZhXEesDe8H6WqhQXZ1tnsDjMbCSo0=
x-evy-trace-route-configuration: listener_https/all
x-request-id: d9c7f761-5351-49eb-ae6f-c36a53c6e8bb
last-modified: Mon, 17 Jun 2024 07:30:29 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tUMII4OxsPtXUtKwwXN9L3QeIx2NbRT%2FtkWL4YT7lt83EyVf636Uh4GI0qYNtbD4DJ1xjlwca6C9lzoL%2BUtqbF%2FdRrDmXrZANFZRhLX%2BrV7rbYwegNIyzFQ5P1w5rSqBIhjGEyp%2F"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-jn7vt
access-control-allow-credentials: false
cf-ray: 8af9436e8d0aaaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: GyDXmiLLqYXlrUGPp2wQ6RzFSupARgkU7Q-n8kze3Ut2LMCHFYCIYQ==

GET
H3 200 prism.min.css
cdnjs.cloudflare.com/ajax/libs/prism/1.23.0/themes/ 2 KB
1 KB 114ms
50ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/prism/1.23.0/themes/prism.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

928e23e6b9fcef82c5f1d1f05b6f7fc5a6e187c60195e59fbf16fc9d071ee057

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5528844
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 563
last-modified: Thu, 31 Dec 2020 20:37:58 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fee36a6-6fd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fbn5hwScf0TLuhJxKE%2FPMcni1aMyIG63ARR7TWpuziSl2hok8T0Z5vDGuWrdZ2%2FIOGfxMeLCbBL3aTX17fAVZ3CiDjvUqmwaOzg9F0bx5ESpGvOLc%2FitQrYakWwbew3sKow9rfg4"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8af9436ee901ac69-YYZ
expires: Mon, 28 Jul 2025 18:17:25 GMT

GET
H3 200 module_101039839309_Footer.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101039839309/1688634802817/ 542 B
2 KB 276ms
271ms Stylesheet
text/css 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101039839309/1688634802817/module_101039839309_Footer.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d65652e4a1175891a46374d16ec569329b2e667eedb5770ce7ce193fd8fd41a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3029
x-amz-request-id: T69PZVWPWA613FQV
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"ed0772c6a57504bedc0b6dd9703ab3f1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634802817
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: aEtuO57JBQ7Fe7bp8NQY6TbBJpxyVa2Z
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 73dadd73-8c53-495e-b73c-67ecf5026bbc
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 353
alt-svc: h3=":443"; ma=86400
x-amz-id-2: PlHOoc+eChV5/2sgY+6XDIDYs43qi9c62i+P02xDdLbfUP+rNzgfiWSwKRq99tyzzReaRwQrTdE=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 73dadd73-8c53-495e-b73c-67ecf5026bbc
last-modified: Thu, 06 Jul 2023 09:13:23 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IMOz3VYQ9T2JmTeZVxzEHhN3Btx79700rhS03m0rOPQIbIdC5c5jyLQIi2e%2BXzSFjvlvn1gOBbfySNLD0zTd0Ol53Hg6Bi4SjnAyik6p8W5ge9tP8ZHZU1yFxRW3D1NrKcYKT9Mk"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-ts7f8
access-control-allow-credentials: false
cf-ray: 8af9436e8d0baaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: RWxJX-gGoAuR5kR2Ctrh7J9JuaRNeCmjDXfrGiHiwe_4q2jjpVLfBA==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 270 KB
94 KB 190ms
50ms Script
application/javascript 2607:f8b0:400d:c09::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SZHLN4DST6

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2205d644b3e645c31a58c0bae87e08df239423cb05a194340255544aa5c2f7d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95966
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 07 Aug 2024 18:17:25 GMT

GET
H3 200 threatfabric-logo-light.svg
www.threatfabric.com/hubfs/Threatfabric/logos/ 3 KB
2 KB 276ms
271ms Image
image/svg+xml 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/logos/threatfabric-logo-light.svg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e082d568fb44df37fa453a514a8e553c889abe144c5c73866c1f020e4ccfbc49

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-101040308776,FD-101040367016,P-6701575,FLS-ALL
age: 221876
x-amz-request-id: 24FKYHQ74AE1W8SG
x-amz-server-side-encryption: AES256
edge-cache-tag: F-101040308776,FD-101040367016,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"8b008611e237cad1162ac34fa0566106"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1675415283131
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 4bb8a49569d535a2508693c45daf94a0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: YCo1pSCjPp8.6ZHhoecaW6WpJqmNwWPZ
x-amz-cf-pop: ORD58-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-101040308776,FD-101040367016,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: jKG/8yxuuaYx5+OzVjLuZ0pTe0j0M2b8IRrr+VFM/3+GCmlPTTeRw5VZ81EYZ/Aflyy7e0+cc+jADbXI1GR/zg==
last-modified: Fri, 03 Feb 2023 09:08:04 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7mAU4QwhbAcsq9SZ9z02vzvt1s3V%2BZrroZ9B4GgvyrdVsL3d8Bbjsx3H9uNpabDm%2FQZE5aWi5ySp2oYb7sy9BZYI8J0zTzEI1zAiKA29seiyuj2G7RKrncax3x2Sz7VZRKQ3ZKyP"}],"group":"cf-nel","max_age":604800}
cf-ray: 8af9436e8d0caaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: 8Wl5r09xJB_x28mVZ2wuTJ6zbSkqsQXH0TuN83U7olo88S5i4-Kefg==

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.971/ 13 KB
5 KB 164ms
25ms Script
application/javascript 2606:4700::6811:ad5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.971/embed.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ad5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98dfeb1d061e8788b320a130a84723813efed0b2518921f30b40cc8a09bf8ecf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
x-amz-version-id: 1gm1MaaLzWiIBc2FerIVtLdckhSMSaY7
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 134f499632d1e15750219cb766bdc50c.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: JFK50-P3
age: 452693
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 Jun 2024 15:05:39 GMT
server: cloudflare
etag: W/"26c40482b55a607cd44486a2958741d4"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2Fr8lOP17gZSNl5OJ0A69PxqPWze1xz9zQUIdSP9nqPBDy8MeC9Xnb5ykDRD%2B6X0aDDVFvnytjLK9ftyLZrlysqOwn8wrLZ4fs0RvgZRcvq2%2BEuK%2FKqvQ4l5JekOl%2BFSDIcBJP%2FABpV%2FVWuBMel5Ibz3gMQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8af943714e8ba2d6-YUL
x-amz-cf-id: fqAPCMeqLoMkrxRJevhbMo06l-AcAnhcxd1s1ByYBAycDcbzAp5vzQ==
expires: Thu, 07 Aug 2025 18:17:25 GMT

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ 87 KB
28 KB 58ms
57ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 431239
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27958
last-modified: Mon, 04 May 2020 23:01:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb09ed3-15d84"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DHgerxc2Fubj7Xahb4klVBu5PvpIOHv8j633BmIhqAXVoS6SXXAuFuzkz4IOm2BOwFAe9LeiTczaKU8RCWrgXktO6pgOL4DDzbbDYaiGvf1GgL34J0%2BYzskc6hsD2bYhAxZ7JmAX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8af9436ef905ac69-YYZ
expires: Mon, 28 Jul 2025 18:17:25 GMT

GET
H3 200 jquery-migrate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.1/ 11 KB
4 KB 33ms
32ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.1/jquery-migrate.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89bf8cdea73ce776d6b81d03837bc7f04af5e3946b839a3c0bfbf3094ad3f7be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 118396
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3592
last-modified: Thu, 25 Jun 2020 01:22:57 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5ef3fc71-2b0b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2F4MStzX1berB9PGZp%2BpXS5GHeqibxBiYqMh6ympGmlfffUZuJSV4Gv7nQxZbWGcNefEtD%2Bo48XklPJlshuIx%2FUOEHT7JAE4u9S5KOLXn%2BOJ4M22JwTMOmzgXO8mlXzRZTjoGm%2Fm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8af9436f796eac69-YYZ
expires: Mon, 28 Jul 2025 18:17:25 GMT

GET
H3 200 plugins.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565705870/1712566990318/Threatfabric_Hatch/js/plugins/ 203 KB
56 KB 61ms
58ms Script
application/javascript 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565705870/1712566990318/Threatfabric_Hatch/js/plugins/plugins.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

42db2b6421ba0667a52a6f929b6f61decd0a6efd16ac1bde0701bcc0e132d4ea

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3029
x-amz-request-id: 51ETDZYGQ2D4GF9K
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"0c0f5074d4f875852639ceb3929df89a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566991454
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: fjOXJuabDfIf8ylKYtupYQJB8ocmEl78
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 04411fe0-2433-4178-8156-d04b7cbed38a
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 208
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1T0XetbZzAIpH2TXyFji0lwNqp+4rNniktRUZeqVjKyR04dtlulRlcobQoWP2MCcLOzqJhEMGSo=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 04411fe0-2433-4178-8156-d04b7cbed38a
last-modified: Mon, 08 Apr 2024 09:03:12 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FKbRdMJEbROtr3f6OtoXYYve5PXZzJkJSMBxTiKmwy46dpcWTtMeAqtlxhPa087XLd2uq9NG3F7VME3HBY6vlZ%2B9Z20C5h%2FfbzuRuDMxq2nuNyfBVrVMlHVsE2XrR0iNYT0qmycb"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-jn7vt
access-control-allow-credentials: false
cf-ray: 8af943706ea5aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: 8YiL-Am_jd6OEvrnU5pL0Ac_fyfKU7Lgnyljj381LGXYFhc-HPR4fg==

GET
H3 200 main.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565738928/1712566988034/Threatfabric_Hatch/js/ 30 KB
8 KB 85ms
82ms Script
application/javascript 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565738928/1712566988034/Threatfabric_Hatch/js/main.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c917923119f99ca28c29eca25a2a4a9606edd23f26633bab2e212ce053dd5f1c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3029
x-amz-request-id: QNDWZ5MDMA326BZK
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"0af793e68edebfa90f8e52a942155cc6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566988355
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: 5wOCXUk6GlkhCRHCrKIei1hIBxtJntKl
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 17da602a-8cbf-4e32-afc9-fec2dbfa1f34
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 268
alt-svc: h3=":443"; ma=86400
x-amz-id-2: jkdxM0L2PoK1YJ94qESWBd5WX+2DYeqXYO+ZaZEkdoMy8ncuBehYo0ms/ahGKzHxwmslhZ2dRy4=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 17da602a-8cbf-4e32-afc9-fec2dbfa1f34
last-modified: Mon, 08 Apr 2024 09:03:09 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T1958gpXodhgNUCYOSeJNSIgzrnnQYgZ52c3%2BmtQfTf76lOfz%2BQGM4QzL5K3BEXhKC0OxV6sNVLM8fe5yNlEilw8y3vUbkgJSHqSXqaZxOsrtYyLqbPIwS4w%2B%2BbRFWilTPV1v27V"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-n2fcv
access-control-allow-credentials: false
cf-ray: 8af943706ea6aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: yCtESV11ewgW5tTpnWHHM3g4SS_dLog7FuwqdkMUpSbTbKfDjxuPZA==

GET
H3 200 child.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040014386/1687845070161/Threatfabric_Hatch/ 654 B
2 KB 78ms
77ms Script
application/javascript 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040014386/1687845070161/Threatfabric_Hatch/child.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c16d59010b5c7bc246cc28fa0b991da4aaf6ed332f99940a4d5bd29de1ad43de

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3029
x-amz-request-id: 51ESH787VVCJN5JY
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"6748e45b4b9a78b567cc67c4bbe101c4"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1687845070347
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: tWyHUvyl_PrBUjYVhQfi.cVUEpkzlair
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 3cd3b69a-9ea6-4f10-a30b-465eefc54c57
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 159
alt-svc: h3=":443"; ma=86400
x-amz-id-2: XNmtCBdNNJSUHrxZwcgHeWG67/ASKEDMnAxFevVZ9pAiUbM2Zop1DGnGmehtxFxNmjFV0IwsrTw=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 3cd3b69a-9ea6-4f10-a30b-465eefc54c57
last-modified: Tue, 27 Jun 2023 05:51:11 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XhdfbYk4a8lbAJRj8lqAuD6YvNrUhOsjrOTFvEeE5IclsUY1O6wpioh6WEXnUvb6DnrZU1vZyWCIdqFpXqSdSestgFEotMatmxsr6BnDoOBrBvC1%2FZxkUHZNB9oq0NEzt5ojcnVO"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-x5qbk
access-control-allow-credentials: false
cf-ray: 8af9436fbe16aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: wRVKyk7ARb5W-66S-GsTZpG-2lUQb_j_kmm5mtg_r2yqP73vJpVpYw==

GET
H3 200 module_-2712622_Site_Search_Input.min.js Show response
cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869176728/ 4 KB
2 KB 46ms
39ms Script
application/javascript 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869176728/module_-2712622_Site_Search_Input.min.js
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 863886e2347be57cf71d7ed3fc614593e94bbce61858cd8c0761ba7a78d2ace4

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
age: 185393
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"f9134a973469f840bf03f740af92c65f"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1722869176728
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: f17bfdd2-d45b-41eb-b5fe-5937eb7460d0
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 157
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: f17bfdd2-d45b-41eb-b5fe-5937eb7460d0
last-modified: Mon, 05 Aug 2024 14:46:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2B7GcVyOfJGk2%2BgJucRKW5TSyZAwD1bedETOrX2DNuHqh7hgFSTTIv4RN%2BWZhf551sfjk2ADZZJM0U9JRnjvmHyluSQBoaSoMkDOhqHvnSCVPqklZOSQCtfd%2FnO6Y2JB9%2BQ%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-dwjx9
cf-ray: 8af943706b99abab-YYZ

GET
H3 200 blog.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565906251/1712566976389/Threatfabric_Hatch/js/ 392 B
2 KB 62ms
55ms Script
application/javascript 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565906251/1712566976389/Threatfabric_Hatch/js/blog.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae37720bad220c27736f9097566e8cec3bce2f45d980f509c193f54d6d4aea59

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3029
x-amz-request-id: 96JNR2RGAB98N409
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"192208997eb533dfcb00b8442296edae"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566976534
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: pqFrH_U2a9yz9fm669sD7mXdUI5HLuH9
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 2db578ca-0e7c-49cf-8541-e885c8e8b281
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 203
alt-svc: h3=":443"; ma=86400
x-amz-id-2: WTuDenlpK2XQWN9ibAXrRpNNxx8jcdhW603XBcfqddggXo8luFEhQSh2QOUJjr/GBl7uR/4f9sbpNaJwqFQ/gDW9eGnDD4PH8hJ4m++jX+M=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 2db578ca-0e7c-49cf-8541-e885c8e8b281
last-modified: Mon, 08 Apr 2024 09:02:57 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UCr3Sce4WBvtlLdIJ7U4JylrxN0SkDYpRFlqEPYiV5oBbuhaUwr2H4h%2FxPgFJT%2Fda6P04rIF68fStac0VeaWveYHy0cdqVfZh7qjNvBAKuaVYncwqUMisIy9iCaUSA28tmmf9VnH"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-n2fcv
access-control-allow-credentials: false
cf-ray: 8af943706ea4aaf8-YYZ
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: rBQZN_RQiw1PSf6iLOBBfaG1DFg6Z2hSKhypfTlhCWrL47Cms6vsYA==

GET
H3 200 beautify.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.8/ 73 KB
14 KB 38ms
34ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.8/beautify.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d5c291cc9ce12740d42109fbf4384252918103351a98793ffa71f764ea3e4cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 186995
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 14063
last-modified: Tue, 09 Jan 2024 00:54:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "659c8b1c-36ef"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FuUG8XKObJ7RHcVCmGj8%2Bh4FOZSMtuaKcOocp9sxDX1Oc3gKnxzdX4lmsPdD1z615QAtxSF%2Fe%2FUq9zEW4Zaj0b1PXPwsMvwrSLA%2FUHOLLW1omo2hAwFspLizGaXDXSUBE%2Fpaq7x7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8af943706a26ac69-YYZ
expires: Mon, 28 Jul 2025 18:17:25 GMT

GET
H3 200 prism.min.js Show response
cdnjs.cloudflare.com/ajax/libs/prism/1.24.1/ 17 KB
6 KB 46ms
42ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/prism/1.24.1/prism.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc377d0b25d1c78cd2fb2d8c9b3cc8fe12db24bd47084deda1129905ca256099

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 501770
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5980
last-modified: Sat, 03 Jul 2021 14:05:42 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "60e06eb6-175c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vSKT4t9y9kQLyyw9DlXMgBbCPgQli1lTM2LYvvHY1daI%2BtPVkLvBgBGQrm5OaiTog0rXNifxzDv7ccaHiEYO6ov0drAmEiGxe1yfM6NJHDzDHvGFV7ySftZt%2Bn6W%2FHSaQetvBQ8X"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8af943706a28ac69-YYZ
expires: Mon, 28 Jul 2025 18:17:25 GMT

GET
H3 200 6701575.js Show response
www.threatfabric.com/hs/scriptloader/ 2 KB
2 KB 151ms
149ms Script
application/javascript 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs/scriptloader/6701575.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7cf20df871728d72302d494076b4edfa5bce7743b15ec7df7a1d93591a43f1a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 0d7828f6-8b43-4430-ab23-173e39d3b69c
content-security-policy: upgrade-insecure-requests
x-envoy-upstream-service-time: 18
alt-svc: h3=":443"; ma=86400
content-length: 680
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0d7828f6-8b43-4430-ab23-173e39d3b69c
last-modified: Wed, 07 Aug 2024 18:17:25 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-85b74c4c74-ctbrl
cache-control: public, max-age=90
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yilUL2ZIvxIh9DnNmDg5w29337%2FmPlN4oHTRizIqlbUJOm2BKSaxtX3C1NjdhTw3mkF7vqso82m2OBbIAXjHeqkIiPnVxR52oiQRjJrMkpDHiIINjIox0UyUf1jU%2BOTLtWp%2FDifN"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 8af943706ea7aaf8-YYZ
expires: Wed, 07 Aug 2024 18:18:55 GMT

GET
H3 200 index.js Show response
www.threatfabric.com/hs/hsstatic/HubspotToolsMenu/static-1.349/js/ 12 KB
5 KB 63ms
61ms Script
application/javascript 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs/hsstatic/HubspotToolsMenu/static-1.349/js/index.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b987245cc5d802ec15d04b1797d14a16f002aca05348c13f79d31ecedecad8ac

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: gzip
via: 1.1 a181621f27665bbfa5459df48eceea5a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1891350
x-amz-cf-pop: YUL62-P1
x-amz-server-side-encryption: AES256
content-security-policy: upgrade-insecure-requests
x-cache: Miss from cloudfront
x-amz-version-id: xQGlP28JK8czygjYT3ac5MmMcZh4SwPp
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 16 Jul 2024 20:51:48 GMT
server: cloudflare
etag: W/"804371e77c152132301ab9a09be49f93"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DsBW2O6xyOgB4gATtCJTj8HvZD2Ra7Ebbrqt1i94RukQ4a3SmCqpkIZNfpdKmr2vmAeHNQh2vXyOr9m1ifYYbFlYvHPDpjJ0wwkrxb43Gl4yCZ69eLhTyV%2BOSc6lOFJjnipKh%2FLE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8af943706eaaaaf8-YYZ
x-amz-cf-id: Cvy7Win_Tbx6tUYQkJCF96h2KMoQRhrxAyCt2qX6RBgHQXQzDM_XKQ==
expires: Thu, 07 Aug 2025 18:17:25 GMT

GET
H2 200 6701575.js Show response
js.hs-scripts.com/ 2 KB
1 KB 166ms
86ms Script
application/javascript 2606:4700::6810:8dd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/6701575.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8dd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e257ffcdedd60833107f3ba75ca01cf29cba53be1a82fc1dcd5a0b91049ab7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e93b4645-7e64-4660-b658-4e91ecb74147
x-envoy-upstream-service-time: 15
content-length: 685
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e93b4645-7e64-4660-b658-4e91ecb74147
last-modified: Wed, 07 Aug 2024 18:17:25 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-85b74c4c74-2mknn
access-control-allow-credentials: true
cache-control: public, max-age=90
accept-ranges: bytes
cf-ray: 8af94370ef9fa272-YUL
expires: Wed, 07 Aug 2024 18:18:55 GMT

GET in.js
platform.linkedin.com/ 0
0

GET
H3 200 tf-blogpost-banner-divider-01.svg
www.threatfabric.com/hubfs/Threatfabric/images/ 576 B
2 KB 101ms
101ms Image
image/svg+xml 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/images/tf-blogpost-banner-divider-01.svg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d92c25b1d90bdf3fb25373c5e3de35b1256f47a96575d58b4e6ae10be499d76d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-102446427186,FD-101619062546,P-6701575,FLS-ALL
age: 221307
x-amz-request-id: Z81NE04B1SR4VTEH
x-amz-server-side-encryption: AES256
edge-cache-tag: F-102446427186,FD-101619062546,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"af4732c5d3ba47ba314c39750f2c2e6f"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1676379615960
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 fdbf0bf4022c61868d8dad6b7d72a71a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: LvbdpHvwKMpHzOWR2c2lhGUzlD608lQ_
x-amz-cf-pop: YTO50-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-102446427186,FD-101619062546,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 8ckFX2893ywksjTBGqXpd1+husHYaEtQPF8MdMdrd8WTUODRI+bJc588ULQaws2ltlwRV435WSH2tsT5+RUofQ==
last-modified: Tue, 14 Feb 2023 13:00:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7EMETL857ujPOHdCmNilFjiPC%2Fh5qG7syLvQtBbKF6UmeU1Z1Z%2FROu4KGKuiEUT5imrAvuRb27hdjNjiTokLq3%2FqW7PJgGcoVuUH1zWadqjVoDi4Nh2V3erW5yBJ7pg27kgprv9Z"}],"group":"cf-nel","max_age":604800}
cf-ray: 8af943709ec4aaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: 9x9h-LL2z2wwGav7zK-T2TfWtkne9TGGaObtTHklRVJUNCz02AJ0Rg==

GET
H3 200 tf-offer-bg-divider-01.svg
www.threatfabric.com/hubfs/Threatfabric/images/ 556 B
2 KB 105ms
104ms Image
image/svg+xml 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/images/tf-offer-bg-divider-01.svg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

639127081177ea5058409066f97e84fb8ffdad426754956248f4ed77b45bd606

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-102241528447,FD-101619062546,P-6701575,FLS-ALL
age: 221473
x-amz-request-id: FG7F5V6H8990VDYB
x-amz-server-side-encryption: AES256
edge-cache-tag: F-102241528447,FD-101619062546,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"3c05186b36e65acf42dc5ace50a34360"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1676276654996
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 56ca3a576467b915b94f2a2737d2ab66.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: .HXvxpbfuTohzDbnYKcJooLLN3h3f42c
x-amz-cf-pop: ORD58-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-102241528447,FD-101619062546,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: T0PVI8ngfZVD/WUfNF6zxVq/VQqyIvEsNXYd5cuxxu96HDrO/wqB9CX2QQFIYN14VmCWZqKOsXw=
last-modified: Mon, 13 Feb 2023 08:24:16 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yXZpMMu2xyUphOu9XO5jUSsWZ%2FdC%2FJTgiyQvBXtA2eVv%2FVwEeBU8gjWSMXNIZPXjkqZCVf8F8eoN9fxGoPXAM7%2FAn8vVYcl4cVdBGqQZDndUUAhFY8F8LUC75188vtldgJ5%2BDftO"}],"group":"cf-nel","max_age":604800}
cf-ray: 8af943709eccaaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: Suv0Z0pVdfF8xYYEflfA15y-lQ8ebn9fAXImTtinhDWZDU6PdldWRA==

GET
H3 200 Kanit-Light.ttf
www.threatfabric.com/hubfs/Threatfabric/fonts/kanit/ 163 KB
64 KB 1011ms
1011ms Font
font/ttf 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/fonts/kanit/Kanit-Light.ttf

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/child.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7b87f1b48aa75784afb205b3d567664641bc056af2e20b5873da2c90605b7d2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/child.min.css
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-112819245065,FD-112819245060,P-6701575,FLS-ALL
age: 221876
x-amz-request-id: 8EDKX4VXDDPT1Z8N
x-amz-server-side-encryption: AES256
edge-cache-tag: F-112819245065,FD-112819245060,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"0c443ef22ca3ce98e0b670310f5ebb36"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/ttf
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1682489433648
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 b734db9b28028c2ed717c3d72b3b45b8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: Tqpimg7QV74KE9DspBbqQUupRuYfGKOs
x-amz-cf-pop: YTO50-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-112819245065,FD-112819245060,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: fHNWstGtLWTknAhVX8dqmnCjmr7m/Bsb6xvk3ldkZpZ/Yn4STUrGS2NeYvXfT100QREA2M4wqkM=
last-modified: Wed, 26 Apr 2023 06:10:34 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L0%2BOhwJnehO5AMk%2Fz3P86sSbI3bxf%2Fyk9OctxzNrq4aB9zIyKRWsEcrGMOSK6pDNF5nINjqGe1EMuKdjdyXUsGQxWFDFwXmBsDgnfZl8FyfR%2FHf6FmxRdA2%2FrTrHd68S4T1NgTiW"}],"group":"cf-nel","max_age":604800}
cf-ray: 8af94370beecaaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: YbPTxNs9FijjbuAkaOOb1p9Zpsv4px8OX26X2MDHMCHIQs-dH008VA==

GET
H3 200 TF_Chameleon_2024.jpg
www.threatfabric.com/hubfs/ 1 MB
1 MB 89ms
88ms Image
image/webp 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/TF_Chameleon_2024.jpg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4a9751170e6da5cc2fcd11f23ac958ad2448eec0e521a6582cc78f40a8b0b50

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-174910066061,P-6701575,FLS-ALL
age: 188753
x-amz-request-id: TR3HWQQ58DH7GMM0
x-amz-server-side-encryption: AES256
edge-cache-tag: F-174910066061,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="TF_Chameleon_2024.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-meta-access-tag: public-indexable
cf-bgj: imgq:85,h2pri
etag: "4b1d028b3b536c5cb6939a65c97ab82c"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1722862138532
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 4bb8a49569d535a2508693c45daf94a0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: O5SpcQIy6.nvASCw9aknnnxLKCEqo1EJ
x-amz-cf-pop: ORD58-P2
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=2634898
x-cache: RefreshHit from cloudfront
cache-tag: F-174910066061,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 1363108
x-amz-id-2: nAqTOZgcpkDi2pGtZrxxkct6V7dpuSRcQtwL4ERs5HDSrlEDn2XU3rrYWFFAlWLOkt89+9t4YX6Tpn8GeHPApJSQ2pK5k5vNo773Hcjn3YQ=
last-modified: Mon, 05 Aug 2024 12:48:59 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JFAdbONzkQGdiSST5eN6gbY%2FIFiZ2nX52MXWK1Kdc2w1c1GrCha8oY%2F%2BjGNoXkg7mGeWBXNXsSPRbVxJSm6sDzXOHhTf%2FuJ9JIy8ldqOn803TgtWs6LlNnuaKVC%2BbI6d1iCif3pm"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 8af94370bee7aaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: 0rJ5Eu_Rkd7sr1liUR-5mwyisnhagmheNTq63tfijTgfVyqZ8B7IhQ==

GET
H3 200 Slide1-Jul-29-2024-03-09-02-8496-PM.png
www.threatfabric.com/hs-fs/hubfs/ 84 KB
85 KB 86ms
86ms Image
image/webp 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hs-fs/hubfs/Slide1-Jul-29-2024-03-09-02-8496-PM.png?width=1920&height=1080&name=Slide1-Jul-29-2024-03-09-02-8496-PM.png

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6efa0b8881d6dab6c36d28b3d869c6369e0e5c134580dcee0940a7208db3a02c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 e6bfe249d47d39a52673337cf444c9ce.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-174297865238,P-6701575,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 85758
cf-resized: internal=ok/m q=0 n=381+336 c=48+288 v=2024.7.0 l=85758
last-modified: Mon, 29 Jul 2024 15:09:04 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cflEh0RnOUfFPWht81OtVC-WdTIKc0wKeDGijcIDPWDQ:acea380d913d323525e46b09990a53c7"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BcxG5eV972O7%2FCYmGxiQxabr%2FrJ15yVxKzMHvKunWU09VqZQ2XqFqwUk7%2FFiZWPrTpcD%2BZBJAIPruC2XQnanGPeCuT2dMB3A10ithgOJD6FhcN3DpxtAtT0LoGx5yJhS1HRsiisu"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 8af94370bee9aaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net

GET
H3 200 Slide2-Jul-29-2024-03-10-32-6973-PM.png
www.threatfabric.com/hs-fs/hubfs/ 38 KB
39 KB 1010ms
1010ms Image
image/webp 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hs-fs/hubfs/Slide2-Jul-29-2024-03-10-32-6973-PM.png?width=1920&height=1080&name=Slide2-Jul-29-2024-03-10-32-6973-PM.png

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

632060d538a0627046b33af9b4ec6718b2efef8361ebbbaf7e49713868a8fe87

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 019b4503d2ffede0ae900992ff140770.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-174297283336,P-6701575,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 39320
cf-resized: internal=ok/m q=0 n=337+287 c=40+247 v=2024.7.0 l=39320
last-modified: Mon, 29 Jul 2024 15:10:34 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfRSTTdm6gNUh2DRch3KgwalN7IKc0wKeDGijcIDPWDQ:eb3a82878b1b824b8470f174e8ffa703"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gLrlYJJ%2FUuM9u7cpmkjdS4vvGVNYhm%2FbewCYlgWK2GjXty7cZ2w9%2FfJ51JT%2BVuVc7x8BpqQK3soxr6PSOkBq4tQ00A165i5dN4mtVukhJRHyI1Mp1%2BtXucZnNAMz%2FuB356anoVs2"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 8af94370beeaaaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 356ms
34ms Script
application/javascript 2600:1408:ec00:1e::1735:23ec
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ec00:1e::1735:23ec Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

cb31bb53eefec5a74b7e7271abd4e97e0735174d7d0b0dec0f2217462573d1f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 28 Jul 2024 07:35:22 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=46764
accept-ranges: bytes
content-length: 14597

GET sdk.js
connect.facebook.net/en_GB/ 0
0

GET widgets.js
platform.twitter.com/ 0
0

GET
H2 200 6701575.js Show response
js.hs-analytics.net/analytics/1723054500000/ 68 KB
25 KB 461ms
130ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1723054500000/6701575.js
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs/scriptloader/6701575.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46938042a68613d2f789863aa1773948f6dae2a485d65e8043f22664f0c485fa

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: MISS
x-amz-request-id: CBRKF98F2F97AG7M
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 78544603-3544-430e-9db4-e403223d340b
x-envoy-upstream-service-time: 18
x-amz-id-2: B9UmTa+Z68xYV+AbU4TstTZdxogUvmXe7EhiYWf5PvzWTMwIKkqKeIDumhUD9x8fYCbU4HUfCzc=
x-evy-trace-listener: listener_https
x-request-id: 78544603-3544-430e-9db4-e403223d340b
x-evy-trace-route-configuration: listener_https/all
last-modified: Sat, 03 Aug 2024 00:27:45 GMT
server: cloudflare
etag: W/"dd168bbc3df36361a1ab57938993c17e"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-g9d49
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8af94373686ba29c-YUL
expires: Wed, 07 Aug 2024 18:22:26 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
24 KB 380ms
50ms Script
application/javascript 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs/scriptloader/6701575.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

720b43e5950b3ef9c934b9253a76353a916cc4399cc2d17bdc5a508ce2569d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1294/bundles/project.js&cfRay=8aeb5f66f96fa284-YYZ
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"ca106ef78092107b8d4a40131d641c01"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1294/bundles/project.js
date: Wed, 07 Aug 2024 18:17:26 GMT
x-amz-version-id: GMZ9HyPHjtzB9hq9Kp4nuMbTlOz7NvmB
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 9e73cc4e-eeb1-4058-b5b3-012835487062
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-evy-trace-route-configuration: listener_https/all
x-request-id: 9e73cc4e-eeb1-4058-b5b3-012835487062
last-modified: Mon, 29 Jul 2024 11:16:10 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=69zjkW9sO4HJyHaxISfUzBa1O2ICi22%2BinZF4OjKQ%2BmvHIWY2c9GWLf8ksiMMQW%2FxyxZqqVIo8InKwuDIFGMXJSBuEFkIyzmWJjLyQbTx9mTIhurTWjZlNcTbQ8dB0HnfCoYKkTLzTlMzYDI"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-2hxmr
cf-ray: 8af943736ecba26c-YUL
x-amz-cf-id: K_sCiHG5RKhTHJfMaQQ0Y2SRTcmh0K449m7Mygvpnso-bKUeT0QOew==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 355ms
25ms Script
application/javascript 2606:4700::6811:80ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs/scriptloader/6701575.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:80ac , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e1b1a37caa8b7627123aeb0e23ad3a2ac14d4ad48be7aabb2ca7ca9da218ef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
x-amz-version-id: UIOsIr3qFS9r3wFn4ECf3yNr1.R8N2aA
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 8f8a8d8a-cdd4-40da-864c-259775cc5894
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.572/bundles/pixels-release.js&cfRay=8af163868cf2a2c2-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
age: 231
x-envoy-upstream-service-time: 10
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8f8a8d8a-cdd4-40da-864c-259775cc5894
last-modified: Tue, 06 Aug 2024 19:11:03 UTC
server: cloudflare
etag: W/"45a803cc17701ff8c7710294960c14c7"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: MISS
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-tmvlw
cf-ray: 8af943737bc6a2ba-YUL
x-amz-cf-id: xX17f-19P7EgxL4SS0UgWmbJqvZfKtApwGTd5jdEqlP0-zBWA6EhOQ==
x-hs-target-asset: adsscriptloaderstatic/static-1.572/bundles/pixels-release.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/6701575/ 75 KB
28 KB 400ms
71ms Script
text/javascript 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/6701575/banner.js
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs/scriptloader/6701575.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca21bb556f4c5d4b3d249e8c26843126facce3d88c00402c0871adeb7799c383

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
x-amz-version-id: 5zHnbWyEsT4TOfUQMfNFlBNy933D_Z26
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: YJ4NMR1XE2JK9R8A
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: e2026cf5-4a3a-46cb-9e4c-72168dc39830
x-envoy-upstream-service-time: 102
x-amz-id-2: 8xurpNwWjfBFPQUPvzrLYgvbBUh6PawDa4ZCECJHdcK6DsmxI7XTmyzz50Jf6svryz31DNEvT34LCXnRNnf6VQ==
x-evy-trace-listener: listener_https
x-request-id: e2026cf5-4a3a-46cb-9e4c-72168dc39830
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 16 Jul 2024 22:33:24 GMT
server: cloudflare
etag: W/"86d757967f20c9c7e5da7b99c9af0077"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-zmwrp
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8af943736e0033ee-YUL
expires: Wed, 07 Aug 2024 18:22:26 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
24 KB 378ms
49ms Script
application/javascript 2606:4700::6810:6ffe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs/scriptloader/6701575.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c78fab07d4ee469def66170220968c4e790992e5adc971a34edc7eabc695e79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
x-amz-version-id: FCxgV_B3nWescR00el0uV0Hdj2lazDBZ
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: caaf2924-d989-4041-a089-0a849e7d3902
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.586/bundles/project.js&cfRay=8aeb5f66f8b96e08-YYZ
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 3
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: caaf2924-d989-4041-a089-0a849e7d3902
last-modified: Tue, 23 Jul 2024 12:55:20 UTC
server: cloudflare
etag: W/"ac41634810840adc02ea51748cb19c2f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-sffzl
cf-ray: 8af943736fdea25a-YUL
x-amz-cf-id: Zk7o3H3JIWH18CAPWwmUR0W3FRaV7bk-V_hS5fCMMgKr4GB5vvAC6Q==
x-hs-target-asset: collected-forms-embed-js/static-1.586/bundles/project.js

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 364ms
68ms XHR
text/plain 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=6701575

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs/hsstatic/HubspotToolsMenu/static-1.349/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: no-sniff
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 9b16c4e5-2aba-4b8f-89bc-903b0d2d03e7
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8af943737e4da251&resource=unknown"
x-evy-trace-listener: listener_https
x-request-id: 9b16c4e5-2aba-4b8f-89bc-903b0d2d03e7
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-td246
cache-control: max-age=0
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
cf-ray: 8af943737e4da251-YUL

GET attribution_trigger
px.ads.linkedin.com/ 0
0

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723054646286&li_adsId=de4fec86-3207-46ce-9b83-e8d704454c67&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeti...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723054646286&li_adsId=de4fec86-3207-46ce-9b83-e8d704454c67&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-target...

0
268 B

318ms
82ms

Image
application/javascript

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723054646286&li_adsId=de4fec86-3207-46ce-9b83-e8d704454c67&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&e_ipv6=AQIWQBAq6wKqYAAAAZEuD2TSULd7CA3e6x8jaH0blOIHR9wLvcJKvgv-rKvuzG2NynPidNdD
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: DE1F49FAB6834C00955CEE14BC4313FA Ref B: YMQ01EDGE0821 Ref C: 2024-08-07T18:17:26Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYfG+wm/nA0Sg5gG+ZUqw==

Redirect headers

date: Wed, 07 Aug 2024 18:17:25 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: B85F9D3FD4004521A6D98FC5DBB1D1EF Ref B: YMQ01EDGE0808 Ref C: 2024-08-07T18:17:26Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723054646286&li_adsId=de4fec86-3207-46ce-9b83-e8d704454c67&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&e_ipv6=AQIWQBAq6wKqYAAAAZEuD2TSULd7CA3e6x8jaH0blOIHR9wLvcJKvgv-rKvuzG2NynPidNdD
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYfG+whvPQcXa0itzEPUQ==

GET
H2 200 attribution_trigger
px.ads.linkedin.com/ 2 B
750 B 267ms
119ms Image
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3969834&time=1723054646286&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:25 GMT
content-encoding: gzip
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: C83DD71D3AD74E5A808FA264ED4EE308 Ref B: YMQ01EDGE0808 Ref C: 2024-08-07T18:17:26Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-lor1
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-li-uuid: AAYfG+wh7XhqicaHwgnD+w==
x-fs-uuid: 00061f1bec21ed786a89c687c209c3fb

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 1 KB
2 KB 90ms
81ms Fetch
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=6701575&currentUrl=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&contentId=174294865261

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d48be5a4ac16e9b30ee152be5286271527e4c4054c2d13ea01a4051645a8e3c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6781c5a4-023c-4a03-9f1d-5958b7b6e096
x-envoy-upstream-service-time: 20
content-length: 665
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6781c5a4-023c-4a03-9f1d-5958b7b6e096
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e77AEHdCr2KJgskgUZylNYruEHUfkqMEHCU%2F68jcHe7zdm5IgX3MN6IArX51H2OOWsUqmsbUsr6iCjhlGtMhhRqKqRI82Hzm%2BS6ontwrSoWWGAtMEXawINDS2eaxHLiFb85BSH7gvfFqWs5lws5Wi%2F7aJ6P0SBFpRew%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8af94374bfbea26c-YUL
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-mg7dh

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 135 B
460 B 222ms
64ms XHR
application/json 2606:4700::6810:6ffe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=6701575&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d4e95bd54c3e6a43268f14f3488db18f087c70f4ba9ee351d31780db8573b76

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 732f7e63-53fc-486e-b2d9-46fc27b9d679
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 732f7e63-53fc-486e-b2d9-46fc27b9d679
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-vn9j6
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8af94375c98fa25a-YUL

GET
H2 200 cf-location Show response
js.hs-banner.com/v2/ 2 B
145 B 145ms
7ms Fetch
text/plain 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/cf-location
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/6701575/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=1500
cf-ray: 8af943758de16e05-YUL
content-length: 2

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
865 B 310ms
50ms Stylesheet
text/css 2607:f8b0:400d:c07::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/6701575/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c07::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 07 Aug 2024 18:17:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 07 Aug 2024 17:43:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Aug 2024 18:17:26 GMT

POST
H2 204 view
js.hs-banner.com/v2/activity/ 0
0 73ms
65ms Fetch 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/v2/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/6701575/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator, envoyset-translator
x-hubspot-correlation-id: 021f8114-fa8b-4fb7-a519-d3f598cb4532
x-envoy-upstream-service-time: 24
x-evy-trace-route-configuration: listener_http/all, listener_https/all
x-evy-trace-listener: listener_http, listener_https
x-request-id: 021f8114-fa8b-4fb7-a519-d3f598cb4532
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-virtual-host: all, all
x-evy-trace-served-by-pod: iad02/private-hubapi-td/envoy-proxy-7f45f7f95b-fzx5w, iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-g9d49
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-allow-origin: https://www.threatfabric.com
access-control-allow-credentials: true
access-control-max-age: 604800
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8af943761e4a6e05-YUL

OPTIONS
H2 200 view
js.hs-banner.com/v2/activity/ Frame 0
0 175ms
56ms Preflight
application/octet-stream 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.threatfabric.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.threatfabric.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 8af943758de46e05-YUL
content-length: 0
content-type: application/octet-stream
date: Wed, 07 Aug 2024 18:17:26 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 0
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-wgwsj
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: e15f3211-996b-4c41-806c-bc5b1ba1ba8b
x-request-id: e15f3211-996b-4c41-806c-bc5b1ba1ba8b

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
928 B 172ms
76ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d3caf3d3-bd16-448b-92a6-1f27450fa7ec
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d3caf3d3-bd16-448b-92a6-1f27450fa7ec
last-modified: Wed, 07 Aug 2024 18:17:26 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-lxhr8
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8af943767e3e39f7-YYZ

GET
H3 200 hs-web-interactive-6701575-139494617102
threatfabric-6701575.hs-sites.com/ Frame 8493 0
0 357ms
297ms Document
text/html 104.19.159.252
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://threatfabric-6701575.hs-sites.com/hs-web-interactive-6701575-139494617102

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.159.252 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: false
alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=10,max-age=5
cache-tag: CT-139494617102,P-6701575,PGS-ALL,SW-2
cf-cache-status: EXPIRED
cf-ray: 8af943767a20ac5d-YYZ
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html;charset=utf-8
date: Wed, 07 Aug 2024 18:17:27 GMT
edge-cache-tag: CT-139494617102,P-6701575,PGS-ALL,SW-2
last-modified: Wed, 07 Aug 2024 18:17:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 91
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/cms-hs-sites-td/envoy-proxy-fffdb9b56-r7xsm
x-evy-trace-virtual-host: all
x-hs-cache-config: BrowserCache-5s-EdgeCache-10s
x-hs-content-campaign-id: 7436f6e2-b46a-4ea1-9c6e-4aa7d59b7348
x-hs-content-id: 139494617102
x-hs-hub-id: 6701575
x-hubspot-correlation-id: 70df1577-367e-41b1-81ae-343a735d89f4
x-request-id: 70df1577-367e-41b1-81ae-343a735d89f4
x-robots-tag: none

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 163ms
37ms Fetch
text/plain 2607:f8b0:400d:c01::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-SZHLN4DST6&gtm=45je4850v896951265za200&_p=1723054645812&gcs=G100&gcd=13q3q3q3q5&npa=1&dma_cps=-&dma=0&tag_exp=95250753&gdid=dZTQ1Zm&cid=329106528.1723054647&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_s=1&sid=1723054646&sct=1&seg=0&dl=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&dt=Chameleon%20is%20now%20targeting%20employees%3A%20Masquerading%20as%20a%20CRM%20app&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1834
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SZHLN4DST6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c01::66 Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Aug 2024 18:17:26 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.threatfabric.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 148ms
55ms Font
font/woff2 2607:f8b0:4004:c07::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 05:03:51 GMT
x-content-type-options: nosniff
age: 566016
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Aug 2025 05:03:51 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 117ms
26ms Font
font/woff2 2607:f8b0:4004:c07::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 04:54:49 GMT
x-content-type-options: nosniff
age: 566558
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Aug 2025 04:54:49 GMT

POST /
px.ads.linkedin.com/wa/ 0
0

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
930 B 83ms
81ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-ca&bfp=2486248749&v=1.1&a=6701575&pi=174294865261&ct=blog-post&ccu=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&cpi=174294865261&cgi=101307487134&lpi=174294865261&lvi=174294865261&lvc=en&pu=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&t=Chameleon+is+now+targeting+employees%3A+Masquerading+as+a+CRM+app&cts=1723054647376&rv=1&vi=04a16e57ce52a861691ebdd692d582e0&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 99f55159-5a10-4b3c-864d-a7cb3adb650e
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 23
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 99f55159-5a10-4b3c-864d-a7cb3adb650e
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SEn61agc%2B88%2BnjYtWjhJ5J6uG6ML8iXG8gJRuK0LCi0HVHCfwJLTcMUw55Mdw7QBOc9MbEv%2Bq46NliUeFDPMCan0DXBeDul%2FXxTL3wr%2B%2F7ZzmzL8PkLmnEGqHmGcO2KN%2B9NXOkJsn7vuxbuqp6H6"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-pbqz5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8af9437a3a98a251-YUL
x-robots-tag: none

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
581 B 66ms
65ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=interactive-shown&value=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: aff22a04-c74e-4f41-be6c-c8d682970afc
x-envoy-upstream-service-time: 5
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: aff22a04-c74e-4f41-be6c-c8d682970afc
last-modified: Wed, 07 Aug 2024 18:17:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-lkwbr
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8af9437a396e39f7-YYZ

GET
H3 200 threatfabric-icon-dark.svg
www.threatfabric.com/hubfs/Threatfabric/favicon/ 467 B
2 KB 53ms
53ms Other
image/svg+xml 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/favicon/threatfabric-icon-dark.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

57a5da7ac787966a0343f72308a274a6efbe29b054c45a39006d357f9a7dd4db

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-113881471036,FD-113881358172,P-6701575,FLS-ALL
age: 221877
x-amz-request-id: MK84XD28J15D042Q
x-amz-server-side-encryption: AES256
edge-cache-tag: F-113881471036,FD-113881358172,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"fce2ca26ec3fee39e3f2c79385fef303"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1683027369208
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 07 Aug 2024 18:17:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 6980e2f97248973ed179341b22d7585e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: QPlhIhds5bQd9SFyVnWczTf6KRniE2eW
x-amz-cf-pop: ORD58-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-113881471036,FD-113881358172,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: sltQHxgkQHdNoDlYHxhUlbzpXNKp53i6WyQEdJsG6QPDGWo2O0T7XVMHRDYpFwrsIfLd4UpRfDc=
last-modified: Tue, 02 May 2023 11:36:10 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K%2FxNEQD%2FbVa2CNJR8JzvJ%2Bm8TnxwphmdGwkVSH4jCWhkB7UrX7IZBS4oPTukec7UipP%2F%2Boa38jSyoNzdOvDT2FOYi%2FQDcNwJrkscUpCKa2W5OUk9EkGextLTIAd4p4uO%2Bl5vtYS9"}],"group":"cf-nel","max_age":604800}
cf-ray: 8af9437a4ecbaaf8-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: 0flgURACPkwVQz5BY3rHgfegRcbQIbY3RWZ6ipf9r3UEnueoU4NjUA==

GET
H2

200

blank001.gif
static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/
Redirect Chain

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=266333855879&containerType=SLIDE_IN&portalId=6701575&audienceId=null&campaignId=7436f6e2-b46a-4ea1-9c6e-4...
https://static.hubspot.com/img/trackers/blank001.gif
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

43 B
662 B

28ms
27ms

Image
image/gif

2606:4700::6811:ad5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

Protocol

Server

2606:4700::6811:ad5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 18:17:32 GMT
via: 1.1 94703ff6f88fa098310f25ad977e6604.cloudfront.net (CloudFront)
x-amz-version-id: MFfZlkR4U8_6aknbgflTSIqo4fNbniK3
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: YTO50-P1
age: 429353
cf-polished: origSize=49, status=webp_bigger
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
cf-bgj: imgq:85,h2pri
last-modified: Thu, 15 Apr 2021 16:47:19 GMT
server: cloudflare
etag: "51416c7ff0b9d7efc8c9b16d84052fab"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rxtncI7SbW%2BH9GX%2FKCZeTmwUZEbgUkl6C4Lp93p8JcYDcERlHpchSZrSKgJWGrb%2BYlarIm9t6ghCv9RoRSMP8Y4AXHbTvBPg3MO70avlcDvIt9PjXYDL1TUVw3YSD%2BGIemNvGl3YFc%2B8bJmpjIC5rMjd2eQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8af94397596ea2d6-YUL
x-amz-cf-id: ngRsk5M2JOVIm27m6Fl5b8vhRa01WAsoPLGmgb-tgFKbF2x9ICTYVg==
expires: Thu, 07 Aug 2025 18:17:32 GMT

Redirect headers

date: Wed, 07 Aug 2024 18:17:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dunCV7HSxBbEZgUmYkR4w1i8v7e%2Fyos1r1xVL%2BEpmy9cCHpHw9MMEcsmZ0b7IAQ0X0voT4xpqYB5DhuFaFrHvQUI%2BXGIgN%2F3F4gADzKpmbKtaGXZMQMIHMnh5I5uP6%2Fo0PZ4IjJUJQYVwRIExqyNjg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif
cache-control: max-age=3600
cf-ray: 8af943971ab1a251-YUL
content-length: 167
expires: Wed, 07 Aug 2024 19:17:32 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: platform.linkedin.com
URL: https://platform.linkedin.com/in.js

Domain: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Domain: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Domain: px.ads.linkedin.com
URL: https://px.ads.linkedin.com/attribution_trigger?pid=3969834&time=1723054646286&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app

Domain: px.ads.linkedin.com
URL: https://px.ads.linkedin.com/wa/

Verdicts & Comments Add Verdict or Comment

62 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.linkedin.com/	1970-01-21 07:23:10	Name: bcookie Value: "v=2&d7f7f7a0-23d6-4516-8621-7ef792ff22ac"
.linkedin.com/	1970-01-21 02:56:46	Name: li_gc Value: MTswOzE3MjMwNTQ2NDY7MjswMjFBjU0DWLogDlOuCzgjyfhYo8DXEAcAApNKN6/Q1iTEDw==
.linkedin.com/	1970-01-20 22:39:01	Name: lidc Value: "b=OGST02:s=O:r=O:a=O:p=O:g=3318:u=1:x=1:i=1723054646:t=1723141046:v=2:sig=AQEDGQu0Iwz31XDt8UBHhTmyjb4zzLxX"
.hsforms.com/	1970-01-20 22:37:36	Name: __cf_bm Value: 9zN9hbQO.DL7K_Rt7e55f62TB..JhAl6heOQ.nPDtwM-1723054646-1.0.1.1-c4TSg2V84j_QQHy9otQlwZb8jlansbnmYlJfeZj8cq8jfxMyWptlrPJgrEqznza3BZJ5uaX9vglOMhIM9JHX7A
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: vI1ZeNSzQA2n363VKQ6HmNSiMveUBhKXXercQhhZrD4-1723054646834-0.0.1.1-604800000
.hs-sites.com/	1969-12-31 23:59:59	Name: __cfruid Value: 5647b3f0612dfb73cf8a4cd4cfc8bb3f64d7b9b4-1723054647
.www.threatfabric.com/	1970-01-20 22:37:36	Name: __cf_bm Value: uzlfIvylTZez38l6DCJDzDbiF95Grusve5s0tTvFbp0-1723054647-1.0.1.1-fZ5_GeuEyHp3hOQ4OtzLLbR7F4xdcl.0siUbnlt1EwAHCv1.1I5XlnNzJzVGicMikhxUXvoJ070jD3Zp7M9m4A
.www.threatfabric.com/	1969-12-31 23:59:59	Name: __cfruid Value: c400939e3197a5237d8c08f5d095a660f1c78d09-1723054647
.hubspot.com/	1970-01-20 22:37:36	Name: __cf_bm Value: XDzaQiOY391DLfwzGsD2oKbN9wubO_iMYNvq7xmiP6c-1723054647-1.0.1.1-MIfwPpLJV4xvRMzpIZke6VybcE1TZLzeSazUgGsTYtVNtbcMREBaHczlAU..UzJpzTX6ncjjKGRTNQKRD0G7pw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: RQkJeQieMBrq.3Zcm2wDyaOKBIH2nSlsaLga5gLrfNY-1723054647459-0.0.1.1-604800000

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app Message: Received a response with no data for rule set "https://www.threatfabric.com/cdn-cgi/speculation-rules?url=www.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app" found in Speculation-Rules header.
security	error	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app Message: Refused to load the script 'https://platform.linkedin.com/in.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .hubspot.com cdnjs.cloudflare.com .hubspot.net .hs-scripts.com .hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net .hs-banner.com .hs-analytics.net .hsadspixel.net js.hscta.net .hscollectedforms.net .hsleadflows.net .hsforms.com .hsforms.net feedback.hubapi.com .usemessages.com snap.licdn.com *.doubleclick.net". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app(Line 1041) Message: Refused to load the script 'https://connect.facebook.net/en_GB/sdk.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .hubspot.com cdnjs.cloudflare.com .hubspot.net .hs-scripts.com .hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net .hs-banner.com .hs-analytics.net .hsadspixel.net js.hscta.net .hscollectedforms.net .hsleadflows.net .hsforms.com .hsforms.net feedback.hubapi.com .usemessages.com snap.licdn.com *.doubleclick.net". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app(Line 1042) Message: Refused to load the script 'https://platform.twitter.com/widgets.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .hubspot.com cdnjs.cloudflare.com .hubspot.net .hs-scripts.com .hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net .hs-banner.com .hs-analytics.net .hsadspixel.net js.hscta.net .hscollectedforms.net .hsleadflows.net .hsforms.com .hsforms.net feedback.hubapi.com .usemessages.com snap.licdn.com *.doubleclick.net". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Message: Refused to connect to 'https://px.ads.linkedin.com/attribution_trigger?pid=3969834&time=1723054646286&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app' because it violates the following Content Security Policy directive: "connect-src 'self' .hubspot.com .hubapi.com .hs-banner.com .hscollectedforms.net .hsforms.com js.hscta.net .google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net".
security	error	URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Message: Refused to connect to 'https://px.ads.linkedin.com/wa/' because it violates the following Content Security Policy directive: "connect-src 'self' .hubspot.com .hubapi.com .hs-banner.com .hscollectedforms.net .hsforms.com js.hscta.net .google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header

Value

Content-Security-Policy

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.hubspot.com
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
cta-service-cms2.hubspot.com
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hubspot.com
perf-na1.hsforms.com
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px4.ads.linkedin.com
snap.licdn.com
static.hsappstatic.net
static.hubspot.com
threatfabric-6701575.hs-sites.com
track.hubspot.com
www.google-analytics.com
www.googletagmanager.com
www.threatfabric.com
connect.facebook.net
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
104.17.24.14
104.18.80.204
104.18.89.62
104.19.159.252
199.60.103.254
2600:1408:ec00:1e::1735:23ec
2606:4700::6810:6ffe
2606:4700::6810:7574
2606:4700::6810:8dd1
2606:4700::6810:a0a8
2606:4700::6811:80ac
2606:4700::6811:ad5b
2606:4700::6812:17b7
2607:f8b0:4004:c07::5e
2607:f8b0:400d:c01::66
2607:f8b0:400d:c07::5f
2607:f8b0:400d:c09::61
2620:1ec:21::14
2620:1ec:50::12
0015f2823b39f602f306802a48c26ed9c8d03e1caf9a7342a9cf2ae07d74898c
0adb227efa2074c6ae2b5e686cf4d1949a6edfc05bd56fa81e34c9a2c69fb50a
0d65652e4a1175891a46374d16ec569329b2e667eedb5770ce7ce193fd8fd41a
115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491
2205d644b3e645c31a58c0bae87e08df239423cb05a194340255544aa5c2f7d0
2d5c291cc9ce12740d42109fbf4384252918103351a98793ffa71f764ea3e4cf
3d4e95bd54c3e6a43268f14f3488db18f087c70f4ba9ee351d31780db8573b76
401925a1114f7003121630392768d35516be54a4028f01024528aeae99a45a56
42db2b6421ba0667a52a6f929b6f61decd0a6efd16ac1bde0701bcc0e132d4ea
46938042a68613d2f789863aa1773948f6dae2a485d65e8043f22664f0c485fa
4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17
5172f440714da51e243a13e0f93911405618326b2013313b682caa428c47e6ef
57a5da7ac787966a0343f72308a274a6efbe29b054c45a39006d357f9a7dd4db
632060d538a0627046b33af9b4ec6718b2efef8361ebbbaf7e49713868a8fe87
639127081177ea5058409066f97e84fb8ffdad426754956248f4ed77b45bd606
6685b4f71edb4ae81b8a710e36f8c794c3e731feeb17614e476daf056b06a824
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6efa0b8881d6dab6c36d28b3d869c6369e0e5c134580dcee0940a7208db3a02c
720b43e5950b3ef9c934b9253a76353a916cc4399cc2d17bdc5a508ce2569d74
74c17452683150ad0f623fdd9a849ba85d73fb9d221cebe9aa11db52969dbe23
7e9c6e361ad47dcbdc817cde52918b29e424ed462fbbcef27ae9d2c826e7ee63
863886e2347be57cf71d7ed3fc614593e94bbce61858cd8c0761ba7a78d2ace4
89bf8cdea73ce776d6b81d03837bc7f04af5e3946b839a3c0bfbf3094ad3f7be
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8e1b1a37caa8b7627123aeb0e23ad3a2ac14d4ad48be7aabb2ca7ca9da218ef5
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
928e23e6b9fcef82c5f1d1f05b6f7fc5a6e187c60195e59fbf16fc9d071ee057
98dfeb1d061e8788b320a130a84723813efed0b2518921f30b40cc8a09bf8ecf
a924c55af6e42515871fdd850703bea91aedd280d30febc3ddc9f674df234785
ae37720bad220c27736f9097566e8cec3bce2f45d980f509c193f54d6d4aea59
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b023c3b26ca69356ad0aa6b6296d5e6a337ec10ca1f8275483437202a03c381c
b4a9751170e6da5cc2fcd11f23ac958ad2448eec0e521a6582cc78f40a8b0b50
b754a50214c3af13ad5b80267b36a52a379030f4cdf28ea62bdc23121fb63963
b7b87f1b48aa75784afb205b3d567664641bc056af2e20b5873da2c90605b7d2
b987245cc5d802ec15d04b1797d14a16f002aca05348c13f79d31ecedecad8ac
c16d59010b5c7bc246cc28fa0b991da4aaf6ed332f99940a4d5bd29de1ad43de
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c564955dad803a6139bc52a7d05b9fcceeec494e5aced6e9db08d20d8ff076ee
c78fab07d4ee469def66170220968c4e790992e5adc971a34edc7eabc695e79f
c917923119f99ca28c29eca25a2a4a9606edd23f26633bab2e212ce053dd5f1c
ca21bb556f4c5d4b3d249e8c26843126facce3d88c00402c0871adeb7799c383
cb31bb53eefec5a74b7e7271abd4e97e0735174d7d0b0dec0f2217462573d1f1
d48be5a4ac16e9b30ee152be5286271527e4c4054c2d13ea01a4051645a8e3c3
d92c25b1d90bdf3fb25373c5e3de35b1256f47a96575d58b4e6ae10be499d76d
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc377d0b25d1c78cd2fb2d8c9b3cc8fe12db24bd47084deda1129905ca256099
e082d568fb44df37fa453a514a8e553c889abe144c5c73866c1f020e4ccfbc49
e257ffcdedd60833107f3ba75ca01cf29cba53be1a82fc1dcd5a0b91049ab7f1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7cf20df871728d72302d494076b4edfa5bce7743b15ec7df7a1d93591a43f1a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa7fe4fd0aef1b94a3910f43b99060d1fcf2b12302726c4f52146ca1f613e516
fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc

www.threatfabric.com Open in urlscan Pro 199.60.103.254 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

67 Requests

90 %HTTPS

74 %IPv6

20 Domains

27 Subdomains

20 IPs

2 Countries

2154 kBTransfer

3419 kBSize

10 Cookies

2 Outgoing links

Redirected requests

67 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.threatfabric.com Open in urlscan Pro
199.60.103.254 Public Scan

Screenshot
Live screenshot

Full Image

67
Requests

90 %
HTTPS

74 %
IPv6

20
Domains

27
Subdomains

20
IPs

2
Countries

2154 kB
Transfer

3419 kB
Size

10
Cookies

67 HTTP transactions
0 data transactions