www.humansecurity.com Open in urlscan Pro
2606:2c40::c73c:67e3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-sc...
Submission: On November 07 via api (November 7th 2024, 8:02:00 am UTC) from IN — Scanned from DE

Summary HTTP 121 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 46 IPs in 4 countries across 37 domains to perform 121 HTTP transactions. The main IP is 2606:2c40::c73c:67e3, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.humansecurity.com.
TLS certificate: Issued by WE1 on November 3rd 2024. Valid for: 3 months.

This is the only time www.humansecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
27	2606:2c40::c7... 2606:2c40::c73c:67e3	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
4	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
11	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2800:233... 2606:2800:233:66b5:799a:7cd3:f74d:7071	15133 (EDGECAST) (EDGECAST)
1	2606:4700::68... 2606:4700::6811:ad5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:10::210:a9a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.66.102.53 18.66.102.53	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6812:1fb0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.102.43.106 104.102.43.106	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a02:26f0:480... 2a02:26f0:480:33::212:40d0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	3.64.143.177 3.64.143.177	16509 (AMAZON-02) (AMAZON-02)
1	18.245.46.44 18.245.46.44	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
2	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.252.225.231 3.252.225.231	16509 (AMAZON-02) (AMAZON-02)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.32.27.19 13.32.27.19	16509 (AMAZON-02) (AMAZON-02)
2	34.107.199.61 34.107.199.61	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	35.190.10.96 35.190.10.96	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8911	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:440... 2606:4700:4400::6812:28f0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.128.38.51 108.128.38.51	16509 (AMAZON-02) (AMAZON-02)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	18.66.102.85 18.66.102.85	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:752b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:762b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:272... 2600:9000:2724:e200:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	34.120.92.56 34.120.92.56	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	104.18.89.62 104.18.89.62	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:275... 2600:9000:275b:1e00:9:14eb:6280:93a1	() ()
1	2606:4700:10:... 2606:4700:10::ac43:b9b	() ()
1	13.224.189.101 13.224.189.101	() ()
121	46

27 2606:2c40::c73c:67e3 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.humansecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:ad5b (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:10::210:a9a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-53.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1fb0 (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.102.43.106 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-43-106.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:33::212:40d0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

client.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.64.143.177 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-64-143-177.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-44.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.252.225.231 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-252-225-231.eu-west-1.compute.amazonaws.com

s.cdnsynd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-19.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.199.61 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 61.199.107.34.bc.googleusercontent.com

stk.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.190.10.96 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 96.10.190.35.bc.googleusercontent.com

collector-pxxdhgmtcm.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
collector-pxf69i9fy8.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8911 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::6812:28f0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.128.38.51 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-38-51.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

001-vjx-104.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-85.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:752b (United States)

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:762b (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2724:e200:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.92.56 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 56.92.120.34.bc.googleusercontent.com

b.px-cdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.18.89.62 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:275b:1e00:9:14eb:6280:93a1 (None, )

ASN- ()

d2i34c80a0ftze.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:b9b (None, )

ASN- ()

acsbapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.101 (None, )

ASN- ()

st.fullcircleinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	humansecurity.com www.humansecurity.com	441 KB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	251 KB
8	px-cloud.net client.px-cloud.net — Cisco Umbrella Rank: 4419 stk.px-cloud.net — Cisco Umbrella Rank: 21462 collector-pxxdhgmtcm.px-cloud.net collector-pxf69i9fy8.px-cloud.net	181 KB
5	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 8959	61 KB
5	zoominfo.com ws-assets.zoominfo.com — Cisco Umbrella Rank: 11155 ws.zoominfo.com — Cisco Umbrella Rank: 4482	20 KB
5	gstatic.com fonts.gstatic.com	105 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34 region1.google-analytics.com — Cisco Umbrella Rank: 3643	22 KB
5	linkedin.com 1 redirects platform.linkedin.com — Cisco Umbrella Rank: 3841 px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	163 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579	10 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	351 KB
3	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2172	19 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5671	4 KB
2	px-cdn.net b.px-cdn.net — Cisco Umbrella Rank: 10655	720 B
2	company-target.com s.company-target.com — Cisco Umbrella Rank: 1520 api.company-target.com — Cisco Umbrella Rank: 4087	1 KB
2	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 5859 track.hubspot.com — Cisco Umbrella Rank: 2324	2 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1472	27 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	75 KB
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 5931 tag-logger.demandbase.com — Cisco Umbrella Rank: 5266	18 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3657	6 KB
2	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8252	2 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 877 script.hotjar.com — Cisco Umbrella Rank: 1177	61 KB
1	fullcircleinsights.com st.fullcircleinsights.com Failed
1	acsbapp.com acsbapp.com	115 KB
1	cloudfront.net d2i34c80a0ftze.cloudfront.net	11 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 812	98 B
1	mktoresp.com 001-vjx-104.mktoresp.com	318 B
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 6755	171 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2191	25 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5740	92 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	303 B
1	cdnsynd.com s.cdnsynd.com — Cisco Umbrella Rank: 10661	64 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 116
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	28 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 5807	5 KB
0	bing.com Failed bat.bing.com Failed
121	37

	Domain	Requested by
27	www.humansecurity.com	www.humansecurity.com client.px-cloud.net
11	cdn.cookielaw.org	www.humansecurity.com cdn.cookielaw.org client.px-cloud.net
5	cdn2.hubspot.net	client.px-cloud.net
5	fonts.gstatic.com	fonts.googleapis.com
4	ws.zoominfo.com	client.px-cloud.net
4	tags.srv.stackadapt.com	www.humansecurity.com tags.srv.stackadapt.com client.px-cloud.net
4	www.google-analytics.com	www.googletagmanager.com www.humansecurity.com
4	www.googletagmanager.com	www.humansecurity.com www.googletagmanager.com
3	js.hs-banner.com	www.humansecurity.com js.hs-banner.com
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	js.zi-scripts.com	www.humansecurity.com js.zi-scripts.com
2	b.px-cdn.net	client.px-cloud.net
2	collector-pxf69i9fy8.px-cloud.net	client.px-cloud.net
2	collector-pxxdhgmtcm.px-cloud.net	client.px-cloud.net
2	stk.px-cloud.net	client.px-cloud.net
2	platform.twitter.com	www.humansecurity.com platform.twitter.com
2	connect.facebook.net	www.humansecurity.com connect.facebook.net
2	client.px-cloud.net	www.googletagmanager.com www.humansecurity.com
2	munchkin.marketo.net	www.humansecurity.com munchkin.marketo.net
2	tracking.g2crowd.com	www.humansecurity.com tracking.g2crowd.com
1	st.fullcircleinsights.com	client.px-cloud.net
1	acsbapp.com	client.px-cloud.net
1	d2i34c80a0ftze.cloudfront.net	client.px-cloud.net
1	track.hubspot.com
1	region1.google-analytics.com	client.px-cloud.net
1	tag-logger.demandbase.com	tag.demandbase.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	api.company-target.com	tag.demandbase.com
1	id.rlcdn.com	www.humansecurity.com
1	s.company-target.com	tag.demandbase.com
1	001-vjx-104.mktoresp.com	munchkin.marketo.net
1	content.hotjar.io	script.hotjar.com
1	js.hs-analytics.net	www.humansecurity.com
1	js.hsleadflows.net	www.humansecurity.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	script.hotjar.com	static.hotjar.com
1	px4.ads.linkedin.com	www.humansecurity.com
1	s.cdnsynd.com	www.googletagmanager.com
1	app.hubspot.com	www.humansecurity.com
1	tag.demandbase.com	www.humansecurity.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	pagead2.googlesyndication.com	www.googletagmanager.com
1	fonts.googleapis.com	www.humansecurity.com
1	cdnjs.cloudflare.com	www.humansecurity.com
1	static.hsappstatic.net	www.humansecurity.com
1	platform.linkedin.com	www.humansecurity.com
0	bat.bing.com Failed	www.humansecurity.com
121	48

This site contains links to these domains. Also see Links.

Domain
docs.humansecurity.com
partners.humansecurity.com
www.facebook.com
twitter.com
www.linkedin.com
github.com
www.cisecurity.org
linkedin.com
t.me
support.humansecurity.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
www.humansecurity.com WE1	`2024-11-03` - `2025-02-01`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2024-06-13` - `2025-06-13`	a year	crt.sh
hsappstatic.net WE1	`2024-11-04` - `2025-02-02`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
zi-scripts.com WE1	`2024-09-22` - `2024-12-21`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
g2crowd.com WE1	`2024-10-19` - `2025-01-17`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-22` - `2025-10-24`	a year	crt.sh
client.botchk.net R11	`2024-09-24` - `2024-12-23`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2024-08-09` - `2025-09-07`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-27` - `2025-09-28`	a year	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-16` - `2024-11-14`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-24` - `2025-07-25`	a year	crt.sh
hubspot.com WE1	`2024-10-03` - `2025-01-01`	3 months	crt.sh
cdnsynd.com E6	`2024-09-25` - `2024-12-24`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA	`2024-08-16` - `2025-09-15`	a year	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
hsleadflows.net WE1	`2024-09-29` - `2024-12-28`	3 months	crt.sh
hs-analytics.net WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh
hs-banner.com WE1	`2024-09-24` - `2024-12-23`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
*.company-target.com R10	`2024-10-14` - `2025-01-12`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-13` - `2025-09-14`	a year	crt.sh
zoominfo.com E5	`2024-10-12` - `2025-01-10`	3 months	crt.sh
*.demandbase.com Amazon RSA 2048 M02	`2024-06-10` - `2025-07-08`	a year	crt.sh
b.px-cdn.net WR3	`2024-10-12` - `2025-01-10`	3 months	crt.sh
hubspot.net WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
acsbapp.com WE1	`2024-10-16` - `2025-01-14`	3 months	crt.sh
aws-st.fullcircleinsights.com Amazon RSA 2048 M02	`2024-05-28` - `2025-06-25`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Frame ID: 3698F183BE3534430F795A9CCF0F6516
Requests: 116 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.humansecurity.com
Frame ID: 4AFDD04A1274B49B72C7027CD5939C08
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.humansecurity.com
Frame ID: 58C427C7CD9D0FCC17F163901FBCCC0C
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: 3072390624CE3DAAF6EB23D1DD541D7B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Satori Threat Intelligence Alert: Konfety Spreads ‘Evil Twin’ Apps for Multiple Fraud Schemes

Detected technologies

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Lightbox (JavaScript Libraries) Expand

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css
owl\.carousel.*\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

121
Requests

96 %
HTTPS

58 %
IPv6

37
Domains

48
Subdomains

46
IPs

4
Countries

2121 kB
Transfer

6083 kB
Size

35
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://docs.humansecurity.com/
Title: Documentation Details about HUMAN's products and interfaces.

Search URL Search Domain Scan URL

URL: https://partners.humansecurity.com/English/?ReturnUrl=%2fEnglish%2fPartners%2fhome.aspx
Title: Partner Portal Log into the HUMAN Partner Portal for collateral, documentation, and other partnership needs.

Search URL Search Domain Scan URL

URL: https://www.facebook.com/secure_with_human
Title: This is a title This is a subtitle Some content goes here..

Search URL Search Domain Scan URL

URL: https://twitter.com/SecureWithHUMAN
Title: This is a title This is a subtitle Some content goes here..

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/humansecurityinc/
Title: This is a title This is a subtitle Some content goes here..

Search URL Search Domain Scan URL

URL: https://docs.humansecurity.com/media-security/ivt-taxonomy
Title: IVT Taxonomy

Search URL Search Domain Scan URL

URL: https://github.com/CaramelAds
Title: GitHub

Search URL Search Domain Scan URL

URL: https://www.cisecurity.org/ms-isac/services/words-of-estimative-probability-analytic-confidences-and-structured-analytic-techniques
Title: high confidence

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Social%20Share%20Buttons&url=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://linkedin.com/shareArticle?mini=true&title=Social%20Share%20Buttons&url=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://t.me/share?url=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://partners.humansecurity.com/English/?ReturnUrl=%2fEnglish%2fPartners%2fhome.aspx&__hstc=233546881.7f9124919ef436acf331cc4180a46d72.1635342799936.1648671054706.1648675289816.112&__hssc=233546881.12.1648738104896&__hsfp=1741684099
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://support.humansecurity.com/hc/en-us
Title: Docs

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/humansecurityinc

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730966514336&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730966514336&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2&e_ipv6=AQKKSl9RML0ZXgAAAZMFpOsg4hKvh-mJimtTnF5zBPAVqiClk9t7UYWk4F8mNPixjN0SjYYQ_7tLScRUeU5RWRUF8J3a

121 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes Show response
www.humansecurity.com/learn/blog/ 233 KB
39 KB 780ms
733ms Document
text/html 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e23ebe6f2b292295569499333c48a8fd2d129cf77951a74eafc324b707720993

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: false
alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=7200,max-age=5
cache-tag: CT-160559355208,CT-172757353219,CT-32703345508,CT-34074471138,CG-5249379964,P-3400937,CW-120410438969,CW-123754977913,CW-166526026759,CW-63656548895,CW-63656638135,CW-63656840557,CW-64556607012,E-115294898870,E-115307132989,E-115307516677,E-115387395449,E-115388248694,E-115450692019,E-115451707707,E-120377909830,E-164610244707,E-164611792452,E-164742850616,E-164742903989,E-166527373913,E-166942765475,E-63463820289,E-63463820290,E-63463820292,E-63463820302,E-63656499996,E-63656586570,E-63656625716,E-63656674711,E-63656841263,E-63656841264,E-68518573488,E-91065958246,E-91065964034,E-99901597287,RA-170315478827,RA-171495719182,RA-172012720271,RA-174301124992,RA-182205049408,RA-182365469266,PGS-ALL,SW-3,GC-166536734550,GC-166958618433,TS-63463820311
cf-cache-status: EXPIRED
cf-ray: 8debcc42595d9104-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html;charset=utf-8
date: Thu, 07 Nov 2024 08:01:53 GMT
edge-cache-tag: CT-160559355208,CT-172757353219,CT-32703345508,CT-34074471138,CG-5249379964,P-3400937,CW-120410438969,CW-123754977913,CW-166526026759,CW-63656548895,CW-63656638135,CW-63656840557,CW-64556607012,E-115294898870,E-115307132989,E-115307516677,E-115387395449,E-115388248694,E-115450692019,E-115451707707,E-120377909830,E-164610244707,E-164611792452,E-164742850616,E-164742903989,E-166527373913,E-166942765475,E-63463820289,E-63463820290,E-63463820292,E-63463820302,E-63656499996,E-63656586570,E-63656625716,E-63656674711,E-63656841263,E-63656841264,E-68518573488,E-91065958246,E-91065964034,E-99901597287,RA-170315478827,RA-171495719182,RA-172012720271,RA-174301124992,RA-182205049408,RA-182365469266,PGS-ALL,SW-3,GC-166536734550,GC-166958618433,TS-63463820311
last-modified: Thu, 07 Nov 2024 08:01:53 GMT
link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HJbw4sMUy7YPmQnm88BW%2BGvFSg14c5xXK5YmV52vCBJw1CZOVKh7FTdSzI6z1YaZgj%2FmqUPLIhVT8o%2BbUqVb3%2BDtSsZEvymquiJBX%2BOy7YB95UzlxLpfVyjT6KZPbVYuYa53JM%2B%2F7QK6YTuLQK4h5RMn%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: origin, Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 502
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/cms-sl-td/envoy-proxy-5bcf5dc485-sqjqb
x-evy-trace-virtual-host: all
x-hs-cache-config: BrowserCache-5s-EdgeCache-7200s
x-hs-content-id: 172757353219
x-hs-hub-id: 3400937
x-hubspot-correlation-id: bc55e2c0-5f97-4df4-9295-56228c1dd2b9
x-request-id: bc55e2c0-5f97-4df4-9295-56228c1dd2b9

GET
H3 200 project.js Show response
www.humansecurity.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 40ms
40ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"61ca66de658cab9587e4636894680d5d"
age: 792725
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CZJEpUfRwR0hoyaqDkAHisoYVWRBkRrcCKBlNNjyS40DKKObwuFcOKbmhhDVIKcy4ierorF19eM2iAIeVIwWvXoA%2FADpIf9TTXyMbWGq1CLRembN5J%2B9h50CSqv%2Fqi%2Bh84rOm%2FtmAu6USEgxRv5fTa6KQg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Fri, 07 Nov 2025 08:01:53 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: IO1SGqgoX4JK2tjBXErxNJPLvDfoPqzBb3GRbAZxlcbLbC7EETuB0A==
date: Thu, 07 Nov 2024 08:01:53 GMT
content-type: application/javascript
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 a66afeef05dba31abba2c6cbc2eaa73c.cloudfront.net (CloudFront)
cf-ray: 8debcc46ebb79104-FRA
x-amz-cf-pop: AMS58-P5
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 frontend.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656586570/1698698464930/humansecurity-hs/punch/assets/css/ 43 KB
9 KB 52ms
51ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656586570/1698698464930/humansecurity-hs/punch/assets/css/frontend.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

afff892691aaab5f3a2c411cb09a2674006120f314eb8ac1fc6efb8c66a1c353

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 19768380-3d8b-4d93-a010-29c1b8b8eb41
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b77d3abc0b9bf83fbcfd36a5a1e3ea4c"
age: 1891
x-amz-version-id: GaNibL_2mws_6v_lkcwwJfeo4CxpHPWp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zz8%2FJikYUcqJfPGqITBfz%2FaG73CNGhC3GS0JXEVcL8rPz5pwIvKePa63pd9NnCibYmN6WAIDmmhB9cRHEJHIhHLLDAJ4NyrbOL0OmGTEpqtJwFFC2gEmz1h4u6vy496T7VL%2FcIUjYMwOKeXBrtNZ9XDltQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: C0hdkr-0JYKASUVHfgdb81-eOD7YSHHNFe27ZwDmHrBDYkSGGPL_RA==
x-hubspot-correlation-id: 19768380-3d8b-4d93-a010-29c1b8b8eb41
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:41:06 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-4hrwm
x-envoy-upstream-service-time: 198
x-amz-request-id: E20GYQ7G57JPMETE
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: HRrfUmrNlZnYH6fIw8hgoP2BOlaWnZ/KZloJ6hutI/b7Uf9jzuF5mPQswSpf5FSFKfpYBaX+6DI=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 b0785dd15b9c7ed21cde8fa5e473d0a2.cloudfront.net (CloudFront)
cf-ray: 8debcc471bc59104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1698698465825

GET
H3 200 variables.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820290/1693233181263/humansecurity-hs/assets/css/dist/ 0
1 KB 79ms
75ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820290/1693233181263/humansecurity-hs/assets/css/dist/variables.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: c5e47e35-fbe0-4d9d-b700-472066e10019
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 1891
x-amz-version-id: PVtlsZaAUzw31xbOkIyAmX4R8T95ZDvv
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Se0F7U7URZ7mWkhqx%2FM7llD3IHC92Kw2XZpEv8bo%2Fuof%2BGbac%2Bq%2BmGZoMYRLhxHx26WFheZF9itpBlLnGm7NbcynULYezTILX%2Fl5ZjidSIyYo0bga4xgyqv0nEgaotupvixpMgmZIWd0ZuufwdKjUOOaiw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: Cx-TYhN3GwAKO6fcb9ZejJpDoRZwPq__Kt5W5CqL46-ja9rX4Xvi_g==
x-hubspot-correlation-id: c5e47e35-fbe0-4d9d-b700-472066e10019
content-type: text/css
last-modified: Mon, 28 Aug 2023 14:33:02 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-x5qbk
x-envoy-upstream-service-time: 193
x-amz-request-id: 8HR5K6H3YVDQ5FQP
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
content-length: 0
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: vf/Et3tfFrKDN+qRHL9tRh5hptpMYr83x+RpN4OEGWyMZH5vFWChdOXW7kiwryF8c+m5wZj34L42Vd+tFY7jMbnmyT3UNdlqlYF3JZ1Yb14=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront)
cf-ray: 8debcc471bc79104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1693233181849

GET
H3 200 main.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/ 79 KB
22 KB 53ms
49ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/main.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0392294081a8113d3c077796594484f5354ebb23b518d3337738015bddb70aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: e114411b-e363-421c-bd5c-125d79879f3d
content-encoding: gzip
cf-cache-status: HIT
etag: W/"47787750df632993e786b00ce189b343"
age: 2886
x-amz-version-id: SAEe3SNv3Lb1_ysCcV6bfhvdbJ82X__.
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UqXPzMXwS23r6%2BLH5s6hdN65kfrJTZIFMMQjY1R0Qo4rSZfiy4Qx%2BoM6d%2Fu1R1fCAzNdEKE9nHndT8AnbTM8htwEIIugww%2BwHbcgBLO2vN2WCc4acpyI8b6Uk76X%2Bl%2BstK8XFzMHAGtFgWBVf2S97RtIqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: cCRKj1H8_r23LDNMn8LhZvcM8htVA3U4FONB7fKEKPiKoPYxoPRCng==
x-hubspot-correlation-id: e114411b-e363-421c-bd5c-125d79879f3d
content-type: text/css
last-modified: Wed, 15 May 2024 15:29:50 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-sf8l8
x-envoy-upstream-service-time: 302
x-amz-request-id: TVCZ7PRD5QJ65HC6
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: ykl2YNNFGc2Gt3f0Cx/2hXVSq84HSWWudF7z8S2xv3t4XzYzSpWNLm4nolDpQTVZilZ0/d49igk=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront)
cf-ray: 8debcc471bc99104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1715786989545

GET
H3 200 single-common.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/ 16 KB
4 KB 61ms
57ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/single-common.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

81f2e0a9e0cbb9cfcb5d72f56f4eff056370ddd14104251fc7066a8f7d641828

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: b605937f-fb07-47df-91c6-5378e04ab44c
content-encoding: gzip
cf-cache-status: HIT
etag: W/"49aab6c32e04790c0f1e45fad3996b2b"
age: 1090
x-amz-version-id: TDjcu_c8CPezB1bGaaBBUci0M.U7cgii
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vJdS4Wjhia2ZfnXG8PI5OF3GFQl%2BG9g6fMViUCzFZDPah2gwgMH9PWspcXmio57dBAWKJ3KetRm%2BFcsZTiGLNmykuqU7y1XdIQ6WvmZSPnGgFBw8S0Nm4UVyLKJahnltsVU0v%2F%2B76MwWIteo4QtfXfRBrw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: -ym0MOaytaKOkhK1jd6pfyCsnDNo5260dvMSfgQpNTGtipSb-xhChw==
x-hubspot-correlation-id: b605937f-fb07-47df-91c6-5378e04ab44c
content-type: text/css
last-modified: Wed, 06 Mar 2024 19:23:23 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-bsggk
x-envoy-upstream-service-time: 226
x-amz-request-id: ESE6N64TX8J969XD
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: NaeqkMw+9kFnJjv6dtEDHu3JeUuiwi/RoPjvGT2b7HaRtd0/SU3xnBF8UwLzLtGME7pQvwFdxJA=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront)
cf-ray: 8debcc471bca9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1709753002890

GET
H3 200 module_166526026759_header-menu-v2.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/module_assets/166526026759/1716224039145/ 843 B
2 KB 67ms
63ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/module_assets/166526026759/1716224039145/module_166526026759_header-menu-v2.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f684971a6600c115bd3d3102c43a0b09ad5a1a3c45a818269445ba888ce8d58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a793ad34-9b7a-4f7a-8f5e-e9326637b55b
content-encoding: br
cf-cache-status: HIT
etag: W/"6805cf8d57acac50bb55afbe7921aa0e"
age: 1891
x-amz-version-id: BzbKtMItj7hwZxg5bjmqXnlAHwZPHzBN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BelpqDKEsIuxtmAQHcy9kaGSlQ5Y%2BVHF%2BLNLGF5YRjZP49jy4Vafwq5be0ho73gaIAEs9BJqRwomHpZKwiCTHDzkBfM7xcOoj192WI7DwNZ3uCeMudPFBk%2B965AAhXx8Tn0nTope5Rl9%2F8C1RX3wp%2FFZKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: eZaI919P7p1TD0NpbJvGVAS4LRsqiKqSiyLJQfnx0EBX3DKPfULkVg==
x-hubspot-correlation-id: a793ad34-9b7a-4f7a-8f5e-e9326637b55b
content-type: text/css
last-modified: Mon, 20 May 2024 16:54:00 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-66f52
x-envoy-upstream-service-time: 506
x-amz-request-id: F4DEBN0XGDTMTFH5
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: e4YCFM47SM++/g6uRSVPVGxmfV50LJfclE56FxKSeS1niWCEuqYmH5y/Z3hCrcKsUQ8/bJfMH5GRqE9HZlT/sCQgAaaj/feK
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront)
cf-ray: 8debcc471bcb9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1716224039145

GET
H3 200 owl.carousel.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742903989/1713364613685/humansecurity-hs/assets/js/owlcarousel/assets/ 3 KB
2 KB 61ms
58ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742903989/1713364613685/humansecurity-hs/assets/js/owlcarousel/assets/owl.carousel.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: bd43132e-5001-4074-9691-5ffa900eb7be
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b2752a850d44f50036628eeaef3bfcfa"
age: 1891
x-amz-version-id: lxA_FGpWvDSJaDwG1OPwtR8dnfjYrFcp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rW9iQAhC0YPeAYuG4ALEwOCA0ud4PfJQlYnsk9gYrzjUdHbJ1yKZdoTFcsmZ%2B5%2FTabUuJjSw6Y%2BCcRd4a5UAETOuB%2Fk29RVrQFzsW%2BLo9wUsX8t5fp3cWtidTfXp6P0t4Y0mljVgE04OiF80lj%2Fs%2B436zg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: kSaUg9liQHgJPPGezORA9RB0lXzYwHX5YwEIziXqaArJCxek8_wTng==
x-hubspot-correlation-id: bd43132e-5001-4074-9691-5ffa900eb7be
content-type: text/css
last-modified: Wed, 17 Apr 2024 14:36:54 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-q9n7k
x-envoy-upstream-service-time: 188
x-amz-request-id: ZDKQ86CAW0JJ9J2M
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: fD4tX1eq/0OgofFFVSzelWFJxTOCgfcIsj0eCRAOAiywPCx3Bgt0QKi3BUZtlb78czhbaYgrEco=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 5084a25d91022b55b5acf281581c6444.cloudfront.net (CloudFront)
cf-ray: 8debcc471bcc9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1713364613685

GET
H3 200 human.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164611792452/1730743584060/humansecurity-hs/assets/css/dist/ 64 KB
17 KB 61ms
58ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164611792452/1730743584060/humansecurity-hs/assets/css/dist/human.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

95076e36507eefb60c3eaf68ca46ec93f299a654adc79633d68d56f33ec22869

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: b670202c-e835-4f91-9be3-c00e6c3eb5a5
content-encoding: gzip
cf-cache-status: HIT
etag: W/"f6932dd29b2ae5ef4050368de885f600"
age: 1891
x-amz-version-id: L_IBMd9HcPuSmG8bLOQPznZaLZNK8HYV
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aQ%2F%2FazJ%2FDDJGLqbue%2FSfLK%2FPWmixcdeXSv8XpXxVaVFOqYBD7b49MSsgWUIWfZfgn9u8MlnOU1N3dhMauoSwPnsRhBvbWt177Iyr23nPcEhti%2B9%2F03YUin3mut43CRMapSNznk5XOSzPiuQplNejlG90uw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: uNMRm2wYBe3165w1uSm9ZQbp3VC0knzs06zyhfEG30zpoIROpj2jdg==
x-hubspot-correlation-id: b670202c-e835-4f91-9be3-c00e6c3eb5a5
content-type: text/css
last-modified: Mon, 04 Nov 2024 18:06:26 GMT
x-amz-replication-status: PENDING
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-72shp
x-envoy-upstream-service-time: 191
x-amz-request-id: E0NEWHXN15NSDR2Y
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: +eGtFiZM7ijZHK1Jm71B3aSPvWS9OWV2gTE4naXe92BwFRJCKwEHv8eSxw/f7lwuOifOZXmcxglHFRBeMCAHAhFGrNg6nmjsRe/Mkg8cBa0=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront)
cf-ray: 8debcc471bcd9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1730743585187

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 383 KB
123 KB 74ms
45ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bd2553bf53cd2bf7e6e0c1ef7ef0aa7b85098dbf74956ddc5057ed5725e4957b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Thu, 07 Nov 2024 08:01:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 08:01:53 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 07 Nov 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 125236
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 46ms
23ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: qVqAwzZMp5y69q24H0KNhg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCFE144367E31E
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 15433
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:53 GMT
content-type: application/javascript
last-modified: Wed, 06 Nov 2024 03:36:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ceba4afd-e01e-00a7-1568-30aa69000000
cf-ray: 8debcc4849c49761-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7212
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 prism.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065964034/1693233180291/humansecurity-hs/assets/css/dist/ 1 KB
2 KB 60ms
58ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065964034/1693233180291/humansecurity-hs/assets/css/dist/prism.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b17ad6eab5f71934277721a0558d12da27ef1c1d7688d3dc8e8440165902526b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a2d954e9-75ea-4a68-9d01-0f823f476e7a
content-encoding: gzip
cf-cache-status: HIT
etag: W/"9f0794436f73e871f1d234b0aed34aaf"
age: 1090
x-amz-version-id: 4AdoQ1qbFlghg5XDq_6m5FKyZgIg_9_9
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s0515qy0X%2FNR5JmWyiY1V103DiUAULURq%2BV7v1YV8cOAvvAUxwRl3IS1FshdZ3IySYOOkiy3jOl8h4s6hFO0zR3Ai1Aat6ajnOIhjCB4AXJ7kjkld1c2QJCPAEKSCMEZ7lDaPHsHl4z%2FkcgiMSe7tYe2vg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: N2dLL7TVUZuHy7f4Kml8Yy7BFULIiIJEIjaybgR9sqKirYvKzqrlXQ==
x-hubspot-correlation-id: a2d954e9-75ea-4a68-9d01-0f823f476e7a
content-type: text/css
last-modified: Mon, 28 Aug 2023 14:33:01 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-n6klc
x-envoy-upstream-service-time: 218
x-amz-request-id: KQ17GH5RDBGTNTPP
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: LkQOceY9aYljJN6AS3owVWACsrL66a1gHgy9GS00qcKCS4tZROHy/zufPHXpAwJXesbQ1ajWP4s=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 52ac015dacdf6aed9db953cf96e66dda.cloudfront.net (CloudFront)
cf-ray: 8debcc471bce9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P3
x-amz-meta-created-unix-time-millis: 1693233180994

GET
H2 200 in.js Show response
platform.linkedin.com/ 510 KB
160 KB 80ms
8ms Script
text/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/48B6) /

Resource Hash

632ae2a19dd0817549172e38d37d628124c089c4466c0dca78378c8a78e3f1e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
age: 2553
x-cdn-proto: HTTP2
x-li-fabric: prod-ltx1
x-content-type-options: nosniff
expires: Thu, 07 Nov 2024 08:19:20 GMT
x-li-proto: http/1.1
x-cache: HIT
date: Thu, 07 Nov 2024 08:01:53 GMT
content-type: text/javascript; charset=UTF-8
x-cdn-client-ip-version: IPV6
vary: Accept-Encoding
last-modified: Thu, 07 Nov 2024 07:19:20 GMT
x-li-pop: prod-ltx1-x
cache-control: public, max-age=3600
x-cdn: ECST
x-li-uuid: AAYmTXP5NTT/XZzmhDSnRA==
accept-ranges: bytes
content-length: 163631
server: ECAcc (ama/48B6)

GET
H3 200 js.cookie-min.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/120377909830/1693233183213/humansecurity-hs/assets/js/dist/ 2 KB
2 KB 63ms
61ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/120377909830/1693233183213/humansecurity-hs/assets/js/dist/js.cookie-min.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9cac5e10bd3d5631c178a838d415c28b126daca61e10e81e6dc36aa18919174f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 29eff51c-0190-4e11-86db-b2ca15ef7147
content-encoding: br
cf-cache-status: HIT
etag: W/"b2d77f293176c0278a1d65d5afe1d1b9"
age: 1891
x-amz-version-id: LVKDx31g5hiRxJMSIPYCqKTZgOeBIIto
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FjnkgcH3KJLg%2BWICRkuR4wctgZmOslxL%2BLIQ9MUYSRtmOemjT2MuGpbndd5cOPu0yxGpNOYvXqW7pT4FCnYcHboJCvTHql0DJDJkfTkKZpw2XGqqnDQhoOrpOoJtMGkJ%2FGS9yyV1JlHBBsylSBDLEMO1WQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: 8E2pPa2YQs_JnqTNsWbTmOPvhtemtF3jXsyZUSjGlupse4avUftC-g==
x-hubspot-correlation-id: 29eff51c-0190-4e11-86db-b2ca15ef7147
content-type: application/javascript; charset=utf-8
last-modified: Mon, 28 Aug 2023 14:33:04 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54797cf595-nxgmh
x-envoy-upstream-service-time: 236
x-amz-request-id: F6X2MEJFDGCBX6M2
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: SvZK6vqAkC02AqWCKTi3ytWotl2f/E2ki12adUHLVhMD8xAMH2+R9l0FiAxsp6Cd2Lio6Ua5aw4=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 10d8c7e85dc4bacbe46fc8920b2edbc4.cloudfront.net (CloudFront)
cf-ray: 8debcc471bd09104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P3
x-amz-meta-created-unix-time-millis: 1693233183379

GET
H3 200 header-lazy.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115388248694/1709752515544/humansecurity-hs/assets/css/ 62 KB
8 KB 74ms
73ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115388248694/1709752515544/humansecurity-hs/assets/css/header-lazy.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

92cde36d24b66c5bb39231c290e47319cc207455557a1c4ddf0b1c584422db77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 959b8cb6-4536-413d-a7d1-e26e481d76d6
content-encoding: gzip
cf-cache-status: HIT
etag: W/"ab9f490b09044ac8accc7cd47c303436"
age: 2886
x-amz-version-id: _V.JkPAY5XMXY1FxwyxeMEqz70RyFn88
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wfuYuw95%2FryQq1%2BlERfyh0Mx0IOi5vFsZQ1v%2F4M2kESI8Glgti3luMb8ZSxNVY7x4IrP%2BT1yYj9bFFAxUcaUCeYbMqxW0e1xVXeK7ervX3XFjn7PcF7jwbIqUijLNKm%2BQwN1hQuxKZ4OrgiR837QZqMuXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: 8ysYxEHDMIVNkn01kaHvAemIIANyt74GpS0Q5RY1teErFEx8Ap0K-w==
x-hubspot-correlation-id: 959b8cb6-4536-413d-a7d1-e26e481d76d6
content-type: text/css
last-modified: Wed, 06 Mar 2024 19:15:17 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-7849459c5c-zmdpq
x-envoy-upstream-service-time: 188
x-amz-request-id: S71R8FEV40HHQCK7
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: USltlvzVuaKYGEIwqunbEftYuGrzymkIi2QZCSfJqQDh2m/x+iYQEZ8nTBA96fP2/ZcSMsYqZFdJJC5dT+O2HA==
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront)
cf-ray: 8debcc471bd19104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1709752516468

GET
H3 200 shield-1.png
www.humansecurity.com/hubfs/ 7 KB
8 KB 65ms
64ms Image
image/webp 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.humansecurity.com/hubfs/shield-1.png

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

adfc35d72ea1d0feaa677acecd2dafad7fdda56b02a76d7f51ad1bc067c2d499

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
cf-cache-status: HIT
etag: "a7f612073c41fe336a127bcdc8c85fb1"
age: 1194240
cache-tag: F-5862207449,P-3400937,FLS-ALL
x-amz-version-id: kbAwIB8JM8ZtMXzHq1eECCWREyj8TPx0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=deLmaN1ZiwXJ8yjFgyMQhTQSI0fbctPEeTUe8WwbJhuYk0RgDyvgn8i7ryb4hIDLHiy4jnS%2FMmnUaz0j9yMMOng6Px7AeTeBJ1xZoz0wh6JrWQ6k%2BtBDiLD6EdkBGdUdwwtaC7Uz%2FtZzEkIO6OT3%2FIl1jw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 5rr2oz77rWEk-kN07VSz5sZRede8fmTtq7oiU3XZxeYlen3aIyVV5w==
content-type: image/webp
content-disposition: inline; filename="shield-1.webp"
last-modified: Fri, 27 Sep 2024 14:40:23 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-5862207449,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: XN8SF4N1RD7XFYHK
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-5862207449,P-3400937,FLS-ALL
content-length: 6658
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: origFmt=png, origSize=12483
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: jkwCgXXp27P4eyX9ADrnY2s44RTWxMaEpw1UkgPopem727smeRwXwvyTyPcjwlMPTRAP3/eJ9Gw=
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 21f03f5333352c6494e837ba1b3bb6ce.cloudfront.net (CloudFront)
cf-ray: 8debcc471bd29104-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1528484841175

GET
H3 200 HMN_Blog-images_2024_Konfety-technical.jpg
www.humansecurity.com/hubfs/ 244 KB
245 KB 819ms
818ms Image
image/jpeg 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.humansecurity.com/hubfs/HMN_Blog-images_2024_Konfety-technical.jpg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

17d527904615bb8d02f2fb91dd08227f626f5ba0aab65d6a820f2eb60fb2c673

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
cf-cache-status: MISS
etag: "ac43d5e9fa12a241c10f9fa8918243b1"
x-amz-version-id: AFUjL0oIFYu1ClDaAcMIAB.M4qworrYw
cache-tag: F-173067260473,P-3400937,FLS-ALL
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cBUdR8T8%2B2Xxep7xppzuruSC49jtyB98LDbbCf0pj7g72%2FPMXr%2Bfm%2BAqgvsNGxvoa0cWqSBfVlTYiNx59UzRwPbvWAPgZz7Q33%2F3gjGg65K%2B8COwaEMdehlrnINEvG4EkYs%2B%2FQzF2OVfOVSN3kEjIXHYwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 1CK0xBmpISgO-CJi6BEwkJMLDEYNPfFLzmVUzE2LqH3SpqFdtto3qA==
content-type: image/jpeg
last-modified: Tue, 24 Sep 2024 18:42:57 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-173067260473,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: TAJX3BFSTFHQ7MJX
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-173067260473,P-3400937,FLS-ALL
content-length: 249848
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:54 GMT
vary: Accept-Encoding
x-amz-id-2: tRtyIK75rFLR8D1XE8iALz36WzckagT/aFwTyYUGhqPZ3TwS2VukqT/vhEmN8lq/x1C3LV12LvFGkPe3V1g5nw==
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 12dba18ae3d66aa7dad74e664431ae9a.cloudfront.net (CloudFront)
cf-ray: 8debcc471bd49104-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1721076655796

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.1293/ 13 KB
5 KB 80ms
59ms Script
application/javascript 2606:4700::6811:ad5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.1293/embed.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ad5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"f667e53d5752ee2e5759f3dfaf20d330"
x-amz-version-id: AFGFBaAC1397GFbOapH2DRIkjQ_NaZzY
age: 179483
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8jwkYH75F2eAV4FrfPkb5ypu15UAmlKU9x6PTj1jtc3l%2BTJEOqpbXrKPPFArHBk8X9jIvTw0uVmYGw2xMD6WiRshqWWIJ798Heff2%2Fu2VTiNo44z0OcVHDcGsEQgRpc6Z6SNXn3CIlRWE2b%2B3autDeeUJq0%3D"}],"group":"cf-nel","max_age":604800}
expires: Fri, 07 Nov 2025 08:01:54 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: Ou-sFMOKDY1ueRHDlKtx-6Q-4URhNnD4Vmd7fS0abhITOtlB3DZlIA==
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript
last-modified: Mon, 23 Sep 2024 19:59:06 GMT
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
cf-ray: 8debcc484d2c4dba-FRA
x-amz-cf-pop: FRA60-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 34ms
19ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "603e8adc-15d9d"
age: 784044
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gCfDEcfBrTT6DpCE9SKCAoCeon5V3tXtU2gYBJ4YM5fV7NBwMBgLO5WkiBD7aOngXRp75MHFXCA0rOgU7lqYlVdpH2lw4GEsmPhcp7fmu79bRpHr10XV5gw5S%2BAuP6KQxjUhle4%2Fcw16jyXAm7KMq5j8"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Tue, 28 Oct 2025 08:01:53 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 07 Nov 2024 08:01:53 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8debcc47b8a51915-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27938
server: cloudflare

GET
H3 200 3400937.js Show response
www.humansecurity.com/hs/scriptloader/ 1 KB
1 KB 416ms
414ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs/scriptloader/3400937.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ce3ba4409684c6edb3a5aab2327b8d6eede74b6ab867ed011d7eb75ff095601

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jYrefIv4gOdW1CIvMk7QUzu7hWjFPluuAOjCmWMihzTz3DPWjoM91bTsXZkObWz8VARbvas%2FUwNNKKo6rGpcojYJm92KOOjgyfRytM02MQRWl4Xn7zb2X6q32KdBPi%2FqopVwjnxmUpLGkfyTH99inwnrtw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 07 Nov 2024 08:03:24 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 07 Nov 2024 08:01:54 GMT
x-hubspot-correlation-id: 35968bb3-3bcf-483b-86aa-19d3a4c9df21
content-type: application/javascript;charset=utf-8
last-modified: Thu, 07 Nov 2024 08:01:54 GMT
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=90
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8debcc482c519104-FRA
accept-ranges: bytes
access-control-allow-origin: https://www.humansecurity.com
content-length: 602
server: cloudflare

GET
H3 200 index.js Show response
www.humansecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/ 12 KB
5 KB 31ms
30ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/index.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

42c7e51d284cd7256caf3bfebf641141876657ea0d6e5588ac7e69dce1e9cf7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"3ef0deda0631561665e95645daf500a2"
age: 237606
x-amz-version-id: O3iI8Pl3bd7LIBbSsE98q3XHW8vfw5hp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c9cejnmmGqcRcbXSPJDY%2Fkl4EoMZcJLEtUg6Q3r8lwX4OxqBSUvmYWPxfYuepmjtWNYyoxIBwOZlZ3orjuZT2LkItHAuXB0LUPcqaKV8rE6LQetdJ3b06qU8%2BfmEl5tiQHfbujLkwKzG3vXI4UzhmWStHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Fri, 07 Nov 2025 08:01:53 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: lzxu4ZBoFaHcm6cOf8ZawHuKZaX2eyW1iEgLgYxQThCrcBzcwb1F-w==
date: Thu, 07 Nov 2024 08:01:53 GMT
content-type: application/javascript
last-modified: Wed, 21 Aug 2024 20:24:20 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 9d1f21fface75767578955e1853e754e.cloudfront.net (CloudFront)
cf-ray: 8debcc482c529104-FRA
x-amz-cf-pop: FRA60-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 prism.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065958246/1693233184177/humansecurity-hs/assets/js/dist/ 21 KB
8 KB 46ms
45ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065958246/1693233184177/humansecurity-hs/assets/js/dist/prism.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

439042e0204db71db38bb4cbe130c3e520d35a14c2d9f65200308eaf1886eb64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 41f55a5b-df95-4ccf-9382-996debd90810
content-encoding: br
cf-cache-status: HIT
etag: W/"e04540ffd56a0772a80fe4364a8bf233"
age: 1089
x-amz-version-id: zkFy2U0v.jSQC8vEXzv06RDRCJ.ugkoT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8RIALysMwZWTgeacjVz7re%2FPkLnCc00K4BeX10q2LC53iB%2B9O3DgUWiUFpDF2WdQBpIvNmAEO%2FxYzQCT7mNyNrVzaLIdl%2FBBpDmyqqt9TUHRLzHM6Ujg%2BaLQCW2v2F6mHtMsf4ZrUknmlxD1tHe%2B%2Bpcr0w%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: uOp5njnQnZlr7Zg3OZPoHCDKg5P_jKDXIpyf_yrLDZpnq4h3YMX0ZA==
x-hubspot-correlation-id: 41f55a5b-df95-4ccf-9382-996debd90810
content-type: application/javascript; charset=utf-8
last-modified: Mon, 28 Aug 2023 14:33:05 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-7849459c5c-b2s92
x-envoy-upstream-service-time: 174
x-amz-request-id: 7RFP04AN4Z4GYR2Y
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: HCBQ4SPXDFmPrpM1vnWPOmQtvzEVezrpgJK+2BDOfqpyV9TW2o5o2npZa/llWDW5Mqzc/20zY2yjWYMXRZg+FQrjs2rNQ6Gy
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 a47a23f37fc6f8e50c6d5f0b1b9273c6.cloudfront.net (CloudFront)
cf-ray: 8debcc482c539104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1693233184509

GET
H3 200 lightbox-combo.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307516677/1698698455711/humansecurity-hs/punch/assets/css/dist/ 8 KB
4 KB 39ms
38ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307516677/1698698455711/humansecurity-hs/punch/assets/css/dist/lightbox-combo.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

671367c3c0e84517f31e61945cd9ba416f89eb653dbc3c4d1828518ef5c627e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 8985f48f-e3a0-4e37-a16a-3cbbb46e2507
content-encoding: gzip
cf-cache-status: HIT
etag: W/"3d743ab0a1949bb9ac17908aa63faff8"
age: 1090
x-amz-version-id: ELy4NSaJEl78PQk9TJ5aF_svDOrYHxB1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D3Vp7JpkFyMyhARFEABnO0DMONiN3gE7XN2ohu4hEInk%2FTmiv8cKoicfXFjy4GuUyi7rpwlW25Dp4ENATkMF2TL7dX6pk0hfDqGF4%2FuTw52PWIzKGuuuILTjV6O9PZbd%2FrsJITfS9D%2BcOPJxJ2KwAcCcRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: pom-0H0h3WAu-bQmFyyGdCIxJHwFArmUF_qyy3hLPjd5MkOHby04tA==
x-hubspot-correlation-id: 8985f48f-e3a0-4e37-a16a-3cbbb46e2507
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:57 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-zn5t2
x-envoy-upstream-service-time: 182
x-amz-request-id: 0GDKDN4MPBT688GZ
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: JjPVdOrwW5njGvBvtdtD6hcTeADxiNgU6iIzXRwj/Yzu8VCJAzg9TCAiTPEGXEjaLAga1NCtkHM=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-ray: 8debcc482c499104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698456389

GET
H3 200 bulma-grid.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841263/1698698444648/humansecurity-hs/punch/assets/css/dist/ 26 KB
5 KB 47ms
45ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841263/1698698444648/humansecurity-hs/punch/assets/css/dist/bulma-grid.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

78142c1a0831423d3fee5308b442b24659445ac8d7c34b92bde6624cc012f4e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 5ec0255d-35c0-47cc-94d5-f38f2233871f
content-encoding: gzip
cf-cache-status: HIT
etag: W/"7e59b5a4545779f41e2037e047741bac"
age: 1090
x-amz-version-id: 9qYDnhWep0M62FVMJnv5CyhdEIgIEl8a
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IIwBLfYU76Wp66vudLd9Lyx4G8rOIjxBs4SS3yBnSDHgVWUYhf59et%2FJSUi37jTbZEOTou2nUKL3HZExc2ai1dQrfeLI4EtIchnjS24hk6J9f9SJAzcPHM7%2FjaksAAvRe6JMRRLTzTGsh8ORf6h9ExtaeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: JyUJomd5JpZo6T1cIY3GZS3N_qxkzOMdz2HHSFMHAdop5G2ZU6XdIA==
x-hubspot-correlation-id: 5ec0255d-35c0-47cc-94d5-f38f2233871f
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:46 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-bhmwl
x-envoy-upstream-service-time: 322
x-amz-request-id: TYAE6W2KQQZF4WR6
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: elLl3RZZpR0TG67HsIWjObO1sqvI6woM/Z7p0/+/YwRKGq7up176jEXXIaGvwiI/7pBelQSMJOaLajfTtQOw2EzOOft7nGAd
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront)
cf-ray: 8debcc482c4b9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698445418

GET
H3 200 flickity.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841264/1698698444616/humansecurity-hs/punch/assets/css/dist/ 2 KB
2 KB 40ms
37ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841264/1698698444616/humansecurity-hs/punch/assets/css/dist/flickity.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

27d001801da9af0f66dfdc4b42a2a22ef3c91682ec36157d1e38c9c75e16bef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 843adfa1-a905-48d7-838a-4ea4dd962415
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b75662d6f54e7a5c27d147376632748f"
age: 1090
x-amz-version-id: Nbji9Bjxg49HIGnuSoWxjDbh9B0ruDRH
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UK6RH%2FDP3xrenOfOMjC3xwIoymN22fP4aFF59OocZyzF5KpF3AqjETOjuBngnkoEf4i5DM%2F3XKv%2BGb%2B7zFzrob1Zm%2FQbRYQFOKqC9CMdw8Nmogoa5kJbUXpwGDzgJeBR7tQV%2BdIooErZRnkbehMwPM0X9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: Axsrshh45egetCV1kOXFT-l38C-8jHSK2wQWpI0lo4Edvw-UHFZyhA==
x-hubspot-correlation-id: 843adfa1-a905-48d7-838a-4ea4dd962415
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:46 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-7849459c5c-6rhmw
x-envoy-upstream-service-time: 170
x-amz-request-id: SEWT2A66B9RQY514
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: ShpHAZZPTuh4NSzpP+sFOFy7KPo50tmAuKOoJGEj/FaPJKqj4MLBL6GJ6oH+I+j003EbR5Sy0Vf49VPmEsBrv0mwxbt9QMxNO24lqgIPYqM=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 88b63cb2f8aab28c7291262ffc15282e.cloudfront.net (CloudFront)
cf-ray: 8debcc482c4c9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698445246

GET
H3 200 custom.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115450692019/1698698457814/humansecurity-hs/assets/css/dist/ 0
1 KB 50ms
47ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115450692019/1698698457814/humansecurity-hs/assets/css/dist/custom.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a9a1c6ad-8826-44d3-9dbe-dc04e91fbb7d
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 1090
x-amz-version-id: yPbyfUQgByZmsXz3Bv8lGkrQvoYQGHox
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7mAhkupuhmc8IrAKIFHLYESSBuZ5iSZxuCzIwHG3QdrNQrO3xcD3uu%2B9BlnKgL%2BwiZGWSHUqzimH2JDcWC8zSHPW2u%2FI26yGlnacYS%2FT0nZarU%2BWc4DMeraGYs%2FJcoYFQrBDzdTmrQURAvs6r9R1h8%2Bbnw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: JGkqNDdKRsEi6BYaN_kGc4HxWnjmEGKqrsJpTXozk08sYEMzteIg5A==
x-hubspot-correlation-id: a9a1c6ad-8826-44d3-9dbe-dc04e91fbb7d
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:59 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-66f52
x-envoy-upstream-service-time: 135
x-amz-request-id: 2XS4Y90FQ4F0AQG0
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
content-length: 0
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: DEmtqfnn0WkXJtnV63tRpm0GcK64JFDjqpqa92gF4UQUn5m5OGJq24lKLZvvhUZ5y88HgfD8QqM=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront)
cf-ray: 8debcc482c4d9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698458499

GET
H3 200 lazy-loading.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307132989/1698698445616/humansecurity-hs/punch/assets/js/ 3 KB
3 KB 48ms
45ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307132989/1698698445616/humansecurity-hs/punch/assets/js/lazy-loading.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0d54140c9e5b41f4f5f8fd5583a8ae657452e2bec968966ab70c26d5ae77719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a08a8dc4-d64e-427f-9646-a33438920732
content-encoding: br
cf-cache-status: HIT
etag: W/"4bad0a4c32f8ed6cc9ae26f79403ba1d"
age: 1090
x-amz-version-id: Yf5CV0qo3j47sw1HNl1JCGV8Teo7T9N0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GgyubnzP0tmCbox%2FVXDNXOKMi63VNzQWp9BScxxO1yWI3%2B4JLGOmgXusuZY%2FviIFEZy2%2BFROHXf8dLpvLp9sqJn9QHJmS0zZsYitmPvZPDTYeW2MYNxask%2BEZBNTp65G7uyT%2FjKRfAoX0P3eKSjatzLFag%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: 5yt_LMrYylPn_lca60khNdvt9H4jgzpMJR5rsIb4eXx0T2qdtX6H5w==
x-hubspot-correlation-id: a08a8dc4-d64e-427f-9646-a33438920732
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:46 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-4cwxm
x-envoy-upstream-service-time: 172
x-amz-request-id: TQ08X82ZA6DMJC51
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: ELyT21Ea9P8LhPvLfZlEFgi/IjDU9CQEDHNf3fE6hDAVbNGs9PauTiYorNZHFEBY9lcSzBLuGP4JL/hBeCevyQ==
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 be4fef3f6c1b2c76e0341ff49a27ce40.cloudfront.net (CloudFront)
cf-ray: 8debcc482c4e9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1698698445767

GET
H3 200 owl.carousel.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742850616/1713364613712/humansecurity-hs/assets/js/owlcarousel/ 43 KB
13 KB 58ms
55ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742850616/1713364613712/humansecurity-hs/assets/js/owlcarousel/owl.carousel.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 55bb2968-e893-4fde-819e-bdf46f42aa27
content-encoding: br
cf-cache-status: HIT
etag: W/"f416f9031fef25ae25ba9756e3eb6978"
age: 1090
x-amz-version-id: YXST8RJs5KZFT1MFRhfRhJxx14M2tAc1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9QfUYPQqY53TDvvItc4NtHmcmvu0jqSHXLCG78756lbIraNRgKeIMfyYqToQuuVcjOLtSEQg2pTob5z9dsEp7aa1UPAkrSudTGaSER88AAisqH1uwkTjdnpyjXNjtZRuGgQetxBqhTwyFnziE%2FeD5xpcYg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: RBkKKs-WO9LoYu0PYwMvDLEgy-a-U-9xs77xYP3LContKngsMPKVHA==
x-hubspot-correlation-id: 55bb2968-e893-4fde-819e-bdf46f42aa27
content-type: application/javascript; charset=utf-8
last-modified: Wed, 17 Apr 2024 14:36:54 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-d8n8d
x-envoy-upstream-service-time: 210
x-amz-request-id: E20JW5PP5MNCA83S
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: M9/Db4G23xGepFqfZW2iuVEmeQHjLYcM5cyP8QNR07R1zJ6M+YC89XqoVtJqsnSQxZW+hEdSPR4=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 19a26748942db0d3fcb162b26019f692.cloudfront.net (CloudFront)
cf-ray: 8debcc482c4f9104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1713364613712

GET
H3 200 frontend.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656674711/1698698447070/humansecurity-hs/punch/assets/js/ 7 KB
4 KB 48ms
46ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656674711/1698698447070/humansecurity-hs/punch/assets/js/frontend.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd5e60442181c68a2711c4a407db551e51e0af167f16b86775ceb7e56679a045

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 187bf549-6d44-42e4-881c-6d8267d961b3
content-encoding: br
cf-cache-status: HIT
etag: W/"a4f49c0d3a6711894e9c55d1c0c7de21"
age: 1090
x-amz-version-id: 9kHHRG.4lQ.A7FuJiqDBrnDLMH9bi.w1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J1MEF1V9zvl8DwCyyirejUAnT6zmXWCisfjQFqSezuKEME3vYFivnv2MjSkZTvvwjxXWWhZuAytk5TFcMhu0uyqv2gvzNrBKzb8%2BZDgzPZ%2B692ckR4T6onEA%2BvHHTgzCoZqWIogTcc8MDSb7Eaz44B0SJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: nQ8jLW7V8QFe0eFXf88A4OReMVIjHjK6MrDWu5AROP7qigYaUyH-SQ==
x-hubspot-correlation-id: 187bf549-6d44-42e4-881c-6d8267d961b3
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:48 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-kmqkd
x-envoy-upstream-service-time: 148
x-amz-request-id: D4X7JSZRR9NZDG8N
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: SxDJaSeTNrNAIim3BqAZiXD/4t0aMmThRYi6PdJ1ktdSsIrYYzgW+YX+mD5YDqgXguLLCDopeWE=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 0fbab52df0695e2a561cd26eb7f9484c.cloudfront.net (CloudFront)
cf-ray: 8debcc482c549104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698447313

GET
H3 200 main.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820292/1701277809330/humansecurity-hs/assets/js/ 5 KB
3 KB 32ms
29ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820292/1701277809330/humansecurity-hs/assets/js/main.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d651066ec06c641549632f4776b2cdbf638ca0786adf1c58f44a2728daed9b00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 8e12b415-cbdd-4b6b-93f2-be1d6a424d4b
content-encoding: br
cf-cache-status: HIT
etag: W/"685174d68af17bd7d0e6a28ceb5be545"
age: 1090
x-amz-version-id: vY8wV06NgfCiTijo9TsZU9.WhSQoNj73
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1qn7iKxIbeXHUk6dAPGVNMqlJ%2F82HuMV7XCJzzCIHwdurUNU9N4R78dl2P3iJ1jyaqmJnDYeqapUyor724L995gFL4xy%2BpbRw7iuv1eLxM7yu4yNPgGm4N%2BPIU4WenZ35nmnEe2Ql6mt471LfHCXxMh82g%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: uEDlRXwRvzY8ETYmYlgGf1MKSjbelsD_SXSWWNTNU4eu-YrS9qNL7Q==
x-hubspot-correlation-id: 8e12b415-cbdd-4b6b-93f2-be1d6a424d4b
content-type: application/javascript; charset=utf-8
last-modified: Wed, 29 Nov 2023 17:10:10 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-n6klc
x-envoy-upstream-service-time: 198
x-amz-request-id: 6R5B0C8YF1T15PP7
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:53 GMT
vary: origin, Accept-Encoding
x-amz-id-2: wSJjNBJVkVSJbmO5KyfoTiKlgojhMg5BcD5Vq9wbRHRAh691/nmHe6oLEe+2/XH32FZzukeBBWQ=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 95ad9d4dc596fb803e3114c8dbdc4b60.cloudfront.net (CloudFront)
cf-ray: 8debcc482c509104-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1701277809525

GET
H2 200 css2
fonts.googleapis.com/ 15 KB
1 KB 44ms
18ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3e96e51bce41e61ed84d7d3bd61411f019a3098dfeaf2230a5a948ee2431471e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 07 Nov 2024 08:01:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 08:01:53 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 07 Nov 2024 08:01:53 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET bat.js
bat.bing.com/ 0
0

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 73ms
38ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
etag: W/"b2877da906a3216c4f3fc4030b205e54"
age: 85196
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: EyAHYYWpQCfZu1vfgiCO2AxDYkErkd6vbp_ehMwxkZd1SmjBVuHFMQ==
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript
last-modified: Thu, 18 Jul 2024 08:13:46 GMT
vary: Accept-Encoding
via: 1.1 e59bea79ab5f15feda92136bc7b74158.cloudfront.net (CloudFront)
cf-ray: 8debcc48a9f092b1-FRA
x-amz-cf-pop: FRA56-P4
server: cloudflare

POST
H3 200 collect
pagead2.googlesyndication.com/ccm/ 0
0 49ms
22ms Ping
text/plain 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&scrsrc=www.googletagmanager.com&frm=0&rnd=1931289866.1730966514&npa=1&gtm=45He4au0v830094232za200&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma=1&tag_exp=101823848~101925629&tft=1730966513988&tfd=1030&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 53ms
4ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
age: 2139
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Thu, 07 Nov 2024 09:26:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 07:26:15 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 288 KB
99 KB 35ms
28ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-878225418&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c4aed508cef0dec6f9ba089beac48f831d4d6cf91020518e6290b4b262434f21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Thu, 07 Nov 2024 08:01:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 07 Nov 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 100530
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 70ms
15ms Script
application/javascript 2a02:26f0:3500:10::210:a9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: max-age=48874
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Thu, 07 Nov 2024 08:01:54 GMT
last-modified: Thu, 22 Aug 2024 10:43:55 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 hotjar-3389720.js Show response
static.hotjar.com/c/ 13 KB
5 KB 93ms
43ms Script
application/javascript 18.66.102.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3389720.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-53.fra56.r.cloudfront.net

Software

Resource Hash

7ffc1868d47d7489ff07ede07129c607fe3f3cc2b2087cc62a666369f9851033

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
content-encoding: br
etag: W/e415318e0cbac1eb68dbb47be3a91058
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
x-cache-hit: 1
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: RefreshHit from cloudfront
x-amz-cf-id: XeFFE5qNWKZWlZyGQoESZ0frxe8hok0XwtXStWIKoUDT1lxtsKP4Dw==
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: FRA56-P2

GET
H2 200 5210.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 2 KB
2 KB 258ms
210ms Script
text/javascript 2606:4700::6812:1fb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/5210.js?p=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&e=

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1fb0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be99b037586f1d31100f6205fb7650348bc715c0091a5495c3cb8ad8a3145ef4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: text/javascript;charset=UTF-8
content-disposition: inline
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
referrer-policy: no-referrer
x-download-options: noopen
cf-ray: 8debcc48ca201c85-FRA
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1
server: cloudflare

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 178ms
46ms Script
application/x-javascript 104.102.43.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-43-106.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Content-Encoding: gzip
ETag: "49bb20382072bfb6b798a6f4c6ab8354:1730261707.305765"
Connection: keep-alive
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 746
Date: Thu, 07 Nov 2024 08:01:54 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 30 Oct 2024 04:15:07 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 main.min.js Show response
client.px-cloud.net/PXxDhGmtcm/ 168 KB
70 KB 87ms
20ms Script
application/javascript 2a02:26f0:480:33::212:40d0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:33::212:40d0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: ef5bd244dd1e8de8413bf166a3b1a4cc37bb7fba87a547001622086b5fcc05fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: max-age=600
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
content-encoding: gzip
etag: "96dc3a16a059d977447745f78429c10d"
active-cdn: Akamai
expires: Thu, 07 Nov 2024 08:09:44 GMT
accept-ranges: bytes
access-control-allow-origin: *
x-goog-stored-content-length: 71263
content-length: 71263
date: Thu, 07 Nov 2024 08:01:54 GMT
last-modified: Thu, 07 Nov 2024 07:10:08 GMT
content-type: application/javascript; charset=utf-8
server: UploadServer
vary: Accept-Encoding

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 164ms
102ms Script
text/javascript 3.64.143.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.64.143.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-64-143-177.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 339f56eb998936df93ed5a98b9bb3f6befdf999fda731e9e2d152d49d3e828a0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: text/javascript

GET
H2 200 1469bf09af802378.min.js Show response
tag.demandbase.com/ 61 KB
18 KB 465ms
410ms Script
application/javascript 18.245.46.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/1469bf09af802378.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.44 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-44.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d5ea4cc18382ea8b4bab715faf7d7e79780f7b49e4b5b4e24bed6161d58cd9b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
x-amz-version-id: gGzcpCiwq0gpveBlMpdJJkXCtl6MzwAx
etag: W/"5f4b5d37106de70ebec5c112598e080f"
x-cache: RefreshHit from cloudfront
x-amz-cf-id: vsgXn93laCkjj3BFga-XHPgStmpfO9Dizei2klF-gLmsV-YaM5o1jQ==
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Tue, 22 Oct 2024 18:41:54 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 aa6c36522a23788dfef1fae9af9fd5e0.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
DATA 200
OK truncated
/ 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 201b591d8778f953b5cde276d197d939dbc151d21e948d0e91d8869901f9eeb8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 Single-Post-Hero-Bg@1x.jpg
www.humansecurity.com/hubfs/Website%20Assets/Backgrounds/ 15 KB
17 KB 33ms
33ms Image
image/webp 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.humansecurity.com/hubfs/Website%20Assets/Backgrounds/Single-Post-Hero-Bg@1x.jpg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/single-common.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b84398de46283985db9507da817ab6fd1c66687b7b9f6d1bf3e0de29bc2b3e28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/single-common.min.css

Response headers

x-robots-tag: none
cf-cache-status: HIT
etag: "dd6b6465df335a37717da6c525533fc1"
age: 615183
cache-tag: F-115446220894,FD-65670907291,P-3400937,FLS-ALL
x-amz-version-id: YO9TbFZMzmWCAQ.yyqbx4F0duFzNtu7i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yTbRoqLYCei%2F4zbo%2FAM5goWIQaGVzzRqqwypCoauE1d2g5vG73Rvrfb9Vk2Wk9EPLho5SPJzYzZVAxooUvYMmKNPrKAqZ8hlDn2x1pRfkr76ZU9ySwex5dra9OkRbvxLgeWxqNF0RgLL2l5Yjy%2BD7jftuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 28aUevlyEiD5gf9aGID5E9-AdWnFRmBOxBMFKWMycRRq46mh4xpV_w==
content-type: image/webp
content-disposition: inline; filename="Single-Post-Hero-Bg@1x.webp"
last-modified: Fri, 27 Sep 2024 14:15:30 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-115446220894,FD-65670907291,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: DTRCJANVE5ZWN6GB
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-115446220894,FD-65670907291,P-3400937,FLS-ALL
content-length: 15628
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: qual=85, origFmt=jpeg, origSize=34092
date: Thu, 07 Nov 2024 08:01:54 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: YbHxewE5kvnne7uDP8hF5f7FbhhJL97QGM7nRlyTVOHGuoJv1OSGbbQ+upsYZMioYkw0tA6PNHc=
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 c0db8c417b5a375429fc7f3c54841604.cloudfront.net (CloudFront)
cf-ray: 8debcc48acbe9104-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1684015842832

GET
DATA 200
OK truncated
/ 378 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2fc92a4b6bcd0e8fdd8b4939e421646379410fc25266f0fb5f1abf07a843f93e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 105ms
59ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 60107
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 06 Nov 2025 15:20:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:20:07 GMT
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21724
x-xss-protection: 0
server: sffe

GET
H3 200 7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 106ms
60ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 59698
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 06 Nov 2025 15:26:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:26:56 GMT
last-modified: Tue, 19 Apr 2022 19:43:23 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21144
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 70ms
24ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 58593
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 06 Nov 2025 15:45:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:45:21 GMT
last-modified: Tue, 19 Apr 2022 19:35:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21796
x-xss-protection: 0
server: sffe

GET
H3 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 21 KB
21 KB 73ms
27ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8320299532b4b81498d5b3714d49c9d5938883b55f4c2a1efe6f105bf4a942bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 58755
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 06 Nov 2025 15:42:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:42:39 GMT
last-modified: Tue, 19 Apr 2022 18:46:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21440
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ 20 KB
20 KB 90ms
45ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 59234
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 06 Nov 2025 15:34:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:34:40 GMT
last-modified: Tue, 19 Apr 2022 19:18:28 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20960
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54a00c1f0eaaeb0537a8297cda238d8d96c0441a708ebaba46e4f473ac94e689

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer

Response headers

Content-Type: font/truetype;charset=utf-8

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 34ms
13ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

126e07fe4635bb161e3cef3e0041dac87c8eb4bf390878de83077a7244a5a3ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: 8d5He/RNDI30cZdgdnP15g==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "82bb3bf9f1dd8dbee457ad2a8d2b701b"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 07 Nov 2024 08:07:57 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 0b6abf7e93aa3810eafc8bb5c599eae0
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4455, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: WbKkZXN7K20gQ7X4qSA6E+aJmfWc0mrno7DVNCgKIBKA2UqYLP0H3zL+CyK/MWsE/8CvzvAMt7qR0ad3+6JaGg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1684
origin-agent-cluster: ?1

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 76ms
28ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
access-control-allow-methods: GET
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Thu, 07 Nov 2024 08:01:54 GMT
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kcgs7200137-IAD, cache-fra-eddf8230088-FRA
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27597
x-amz-server-side-encryption: AES256

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 4AFD 0
0 264ms
7ms Document
text/html 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.humansecurity.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 171122
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Nov 2024 08:29:52 GMT
expires: Wed, 05 Nov 2025 08:29:52 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 10c1c946-3ec8-49a0-92ce-5be53945f2bc.json Show response
cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/ 4 KB
2 KB 80ms
40ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/10c1c946-3ec8-49a0-92ce-5be53945f2bc.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4a42e8f77ed647b32311ffc6b611bdc77b6296726e51cfc958ac736c63a6654

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: gKPVf/0JY7LPyMXBubVDLg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DB817650AF29D1
age: 38095
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 08 Nov 2024 08:01:54 GMT
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json
last-modified: Mon, 10 Jul 2023 18:48:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 177d59bd-c01e-005e-4b4c-266089000000
cf-ray: 8debcc4a0ead1d88-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1651
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 176ms
133ms XHR
text/plain 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=3400937

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a23f2efe-3ab8-45e5-af82-917df2c9a38b
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-methods: GET
x-content-type-options: no-sniff
x-evy-trace-listener: listener_https
date: Thu, 07 Nov 2024 08:01:54 GMT
x-hubspot-correlation-id: a23f2efe-3ab8-45e5-af82-917df2c9a38b
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8debcc4a1a649741&resource=unknown"
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-86c46c9777-cgnmm
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
cf-ray: 8debcc4a1a649741-FRA
access-control-allow-origin: https://www.humansecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H/1.1 204
No Content clear.js Show response
s.cdnsynd.com/2/259353/ 0
64 B 212ms
38ms Script
text/plain 3.252.225.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.cdnsynd.com/2/259353/clear.js?dt=2593531613684042609000&pd=mkt&gci=397273522.1730966514&gtr=UA-111948466-3&gdc=1&gdb=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 3.252.225.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-252-225-231.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Date: Thu, 07 Nov 2024 08:01:54 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
407 B 8ms
7ms Image
image/gif 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1117056761&t=pageview&_s=1&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&ul=de-de&de=UTF-8&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGAAgAABAAAAAAAEKk~&cid=397273522.1730966514&tid=UA-111948466-2&_gid=703013032.1730966514&gtm=45He4au0n81KVP42DDv830094232za200&cd7=2024-11-07T09%3A01%3A53.990%2B01%3A00&cd8=4026ed49-e258-440a-97ed-ac594eaf4713&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma=1&tag_exp=101823848~101925629&cd3=397273522.1730966514&npa=1&z=1258579639

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

age: 60960
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:05:54 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
94 B 9ms
9ms Image
image/gif 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1117056761&t=pageview&_s=1&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&ul=de-de&de=UTF-8&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGgAAAABAAAAAAAEKk~&cid=397273522.1730966514&tid=UA-111948466-3&_gid=1160156003.1730966514&gtm=45He4au0n81KVP42DDv830094232za200&cd1=397273522.1730966514&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma=1&tag_exp=101823848~101925629&cd2=Human&npa=1&z=2111640268

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

age: 60960
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:05:54 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
587 B 186ms
185ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 51dc7dc0230a49f9165be029ce8209574533ac04b2c617b62c06250684e154a2

Request headers

Authorization: Bearer a6151318a91681741142
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"cb-5aoIIo9+UFWkS8pRREr+jmL0DmM"
apigw-requestid: A3cN-gSlvHcEN0w=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: S2DcR1-quPavKNTzDA4w7vZTRHTDq_e7OEaBA47DtJySefK4pfAo8w==
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json; charset=utf-8
vary: Origin
via: 1.1 82386e4e4f56a0c01411d1aea6f3fd46.cloudfront.net (CloudFront)
cf-ray: 8debcc4bdf307188-FRA
access-control-allow-origin: https://www.humansecurity.com
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
server: cloudflare

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 192ms
172ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=86400
apigw-requestid: A3cN8ht3PHcEMEQ=
cf-cache-status: DYNAMIC
cf-ray: 8debcc4abe5e7188-FRA
date: Thu, 07 Nov 2024 08:01:54 GMT
server: cloudflare
vary: Origin
via: 1.1 e59bea79ab5f15feda92136bc7b74158.cloudfront.net (CloudFront)
x-amz-cf-id: 4hrkjaqcTj_N0t5YJT1d8oqXRE4vinMnC_no4_7blcw-A1UAwb4abw==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
624 B 254ms
204ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 9BA7037D754943C6B4E8BEB81D1D1F96 Ref B: FRAEDGE1412 Ref C: 2024-11-07T08:01:54Z
x-li-fabric: prod-lor1
access-control-allow-credentials: true
x-li-uuid: AAYmTgw2paNfCvQLhm06+A==
x-li-proto: http/2
access-control-allow-origin: https://www.humansecurity.com
x-cache: CONFIG_NOCACHE
date: Thu, 07 Nov 2024 08:01:54 GMT
vary: Origin

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
812 B 239ms
192ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=1755754%2C5211716&time=1730966514336&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 0006264e0c3689cc25957c987ff4e733
x-msedge-ref: Ref A: 17C266774B464F308924208E37A0232A Ref B: FRAEDGE2010 Ref C: 2024-11-07T08:01:54Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYmTgw2icwllXyYf/TnMw==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730966514336&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evi...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730966514336&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-ev...

0
264 B

246ms
188ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730966514336&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2&e_ipv6=AQKKSl9RML0ZXgAAAZMFpOsg4hKvh-mJimtTnF5zBPAVqiClk9t7UYWk4F8mNPixjN0SjYYQ_7tLScRUeU5RWRUF8J3a
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 23644A77636248359E4A747F4BFB6DB1 Ref B: FRAEDGE1116 Ref C: 2024-11-07T08:01:54Z
x-li-fabric: prod-lor1
x-li-uuid: AAYmTgw77iBIJ0h7ZAeN1g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730966514336&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2&e_ipv6=AQKKSl9RML0ZXgAAAZMFpOsg4hKvh-mJimtTnF5zBPAVqiClk9t7UYWk4F8mNPixjN0SjYYQ_7tLScRUeU5RWRUF8J3a
x-msedge-ref: Ref A: E5663B3CB3BF4B55885CA41C8F8FA1B1 Ref B: FRAEDGE1412 Ref C: 2024-11-07T08:01:54Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYmTgw2VS5DbxeDMxQ4VQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 07 Nov 2024 08:01:54 GMT

GET
H2 200 modules.6f60e575cf8ad7cb10f7.js Show response
script.hotjar.com/ 222 KB
55 KB 45ms
11ms Script
application/javascript 13.32.27.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.6f60e575cf8ad7cb10f7.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3389720.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-19.fra56.r.cloudfront.net

Software

Resource Hash

f0a9b19d1615e0e2afdca507d4c7cbe384b0bdfad5cbaf63c14a386df33a62d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
content-encoding: br
etag: "56b1b49a4bdc4c874445907df778d045"
age: 236516
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: ECBYpUaS9VNPXO4SU8WqaH3GgMtad-I8scySeeGUs4YG91hhU4jDDw==
date: Mon, 04 Nov 2024 14:19:58 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 Nov 2024 14:19:24 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56128
x-amz-cf-pop: FRA56-C2

GET
H/1.1 200
OK ns Show response
stk.px-cloud.net/ 350 B
484 B 81ms
19ms XHR
text/html 34.107.199.61
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://stk.px-cloud.net/ns?c=8d93ef50-9cde-11ef-8e13-25c518d44a2d
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.107.199.61 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 61.199.107.34.bc.googleusercontent.com
Software: /
Resource Hash: bcd54b12a92c0c934aaea3dd9b81344714308f128b0d84b6455b25636946dd9d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Access-Control-Allow-Origin: *
Content-Length: 350
Date: Thu, 07 Nov 2024 08:01:54 GMT
Content-Type: text/html

POST
H2 200 collector Show response
collector-pxxdhgmtcm.px-cloud.net/api/v2/ 540 B
788 B 212ms
137ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxdhgmtcm.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 6da34af8a0423529c070242c7a9582fc4ef2b0458c12f7077d4b18303bb0e6a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 540
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json; charset=utf-8

GET
H2 200 main.min.js Show response
client.px-cloud.net/PXf69I9fY8/ 256 KB
108 KB 341ms
341ms Script
application/javascript 2a02:26f0:480:33::212:40d0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:33::212:40d0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: c07c809080e9588aca7e98461b0b28f6df1ddc0333efc1876e35a65f0e9da999

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: max-age=600
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
content-encoding: gzip
etag: "bfd9fc8c7a0a65309b99ee73f14b7b55"
active-cdn: Akamai
expires: Thu, 07 Nov 2024 08:11:25 GMT
accept-ranges: bytes
access-control-allow-origin: *
x-goog-stored-content-length: 109994
date: Thu, 07 Nov 2024 08:01:54 GMT
last-modified: Thu, 07 Nov 2024 08:00:17 GMT
content-type: application/javascript; charset=utf-8
server: UploadServer
vary: Accept-Encoding

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
303 B 151ms
47ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8debcc4beccc9226-FRA
access-control-allow-origin: *
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 248 KB
73 KB 31ms
22ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=eea3db0b0acad63f26a581614dd02dca

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5db7ebaf5c59a393c37e60c30e2d80c32e24cd7b49c02e04a14e10bd4a3e31b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: L/ASZ8ddjGaA60hUMBSvlg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "c148913b577c184b0a1c9aba68caef5c"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 07 Nov 2025 06:17:34 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 9e483c1ae80ca196fe18e8776d865e5d
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=1826, tp=5, tpl=0, uplat=0, ullat=-1
x-fb-debug: bF2vGpgSoFUllbvzFdz733w7uhkPP/rQbipZlUuiTwGobMNxPyWFaIXs2PeOD6hevEoJUgeIT8LBFKwItk0pcQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 75075
origin-agent-cluster: ?1

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 16ms
15ms Script
application/x-javascript 104.102.43.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-43-106.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Sat, 15 Feb 2025 08:01:54 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Thu, 07 Nov 2024 08:01:54 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 108ms
96ms Stylesheet
text/css 3.64.143.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.64.143.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-64-143-177.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: c564b7cedb11c28a97fe8292fc8d20bf6b8e0ede52994d80f55c7c8a082c6700

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 127ms
99ms Fetch
image/jpeg 3.64.143.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.64.143.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-64-143-177.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: image/jpeg

GET
H2 200 widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 58C4 0
0 45ms
18ms Document
text/html 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.humansecurity.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105429
content-type: text/html; charset=utf-8
date: Thu, 07 Nov 2024 08:01:54 GMT
etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
last-modified: Mon, 11 Dec 2023 17:19:49 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kiad7000164-IAD, cache-fra-eddf8230084-FRA

POST
H2 200 assign
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 130ms
123ms Ping
text/html 2606:4700::6812:1fb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by: Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/5210.js?p=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&e=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1fb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6mCKV7BMhaD3R5xa
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 550 KB
92 KB 83ms
20ms Script
application/javascript 2606:4700::6812:8911
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/scriptloader/3400937.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8911 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d44882ab82adeef2856a0d52fb54bb70e472be45d50aa3a16b4cb39223391a99

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 088395a6-d810-42cf-a2b9-05f9f9a88c3a
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 1P48dmUoAxkQ57N6qBxgDzS3oBmZAXBF
etag: W/"ce26171eff05376a1b746efbb809f7f6"
age: 56564
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: iMC9YNz-i9qCGKOSZqBA39tb7ZELpYP1uO_ASqasbEefPBUYB-PG6Q==
x-hubspot-correlation-id: 088395a6-d810-42cf-a2b9-05f9f9a88c3a
content-type: application/javascript; charset=utf-8
last-modified: Wed, 09 Oct 2024 10:17:06 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=86400, max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-86c46c9777-tzjb2
x-envoy-upstream-service-time: 6
x-hs-target-asset: lead-flows-js/static-1.1724/bundle/main/lead-flows-release.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Thu, 07 Nov 2024 08:01:54 GMT
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1724/bundle/main/lead-flows-release.js&cfRay=8de667587e0fe507-FRA
via: 1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront)
cf-ray: 8debcc4bfae02bd1-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 3400937.js Show response
js.hs-analytics.net/analytics/1730966400000/ 68 KB
25 KB 243ms
182ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1730966400000/3400937.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/scriptloader/3400937.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bfe0695ae8a623e3bfb51affa85f41a5593014633878b4489b449d3a37a444b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-amz-server-side-encryption: AES256
x-request-id: cdb32589-0cb1-4b36-9b0c-471e32c638c7
content-encoding: gzip
cf-cache-status: MISS
etag: W/"6089bc2ec0488a8b060be0412ff3099d"
x-amz-version-id: null
expires: Thu, 07 Nov 2024 08:06:54 GMT
x-evy-trace-listener: listener_https
date: Thu, 07 Nov 2024 08:01:54 GMT
x-hubspot-correlation-id: cdb32589-0cb1-4b36-9b0c-471e32c638c7
content-type: text/javascript
last-modified: Tue, 22 Oct 2024 20:41:08 GMT
vary: origin, Accept-Encoding
x-amz-id-2: uO03TuJd3CTo1Lo8nMlbE5iNu9d0l2ZM7Bl3jy6wXAqBplN6DlpBXEiYLB9pZOTb6fDiqblocvo=
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-h5sr5
x-envoy-upstream-service-time: 26
access-control-allow-credentials: false
x-amz-request-id: YQTSWARS13ZHQZ3B
cf-ray: 8debcc4bfe956955-FRA
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 3400937.js Show response
js.hs-banner.com/ 61 KB
19 KB 77ms
17ms Script
text/javascript 2606:4700:4400::6812:28f0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3400937.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/scriptloader/3400937.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02a711f90cf3fe3f3c91c838aa383dd9bc60d67b59e678328975e2193c1ce1d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-evy-trace-virtual-host: all
access-control-max-age: 604800
x-request-id: 987274a5-dc96-4c34-b00e-4c781517bb06
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding: gzip
cf-cache-status: HIT
etag: W/"7df6ee72098e64058dcb0f86caf8fbf0"
x-amz-version-id: j3Z3MHDFFIrOvQEWaUYKy.NfZW7yr8Jm
age: 167
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires: Thu, 07 Nov 2024 08:04:07 GMT
x-evy-trace-listener: listener_https
date: Thu, 07 Nov 2024 08:01:54 GMT
x-hubspot-correlation-id: 987274a5-dc96-4c34-b00e-4c781517bb06
content-type: text/javascript; charset=UTF-8
last-modified: Fri, 29 Mar 2024 16:23:31 GMT
vary: origin, Accept-Encoding
x-amz-id-2: u5mdxc0Y0DPyNvn3y8GEa28tudT8QiYE16W/LBe6+63HtOOWv6Z5IU5ypq78WVS6pHuhKrIUB/Q=
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
timing-allow-origin: *
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-75d7846cb8-ngl7b
x-envoy-upstream-service-time: 34
access-control-allow-credentials: true
x-amz-request-id: VVJSS6MGV0FKD82F
cf-ray: 8debcc4bf925d2c2-FRA
access-control-allow-origin: https://www.humansecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 200 / Show response
content.hotjar.io/ 56 B
171 B 250ms
75ms XHR
application/json 108.128.38.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=3389720&gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.6f60e575cf8ad7cb10f7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.128.38.51 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-108-128-38-51.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f72f1ba055250d787ae6b4adbfb82f5bce37fb21837391da42fc4268e1213fcb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 86400
access-control-allow-origin: *
content-length: 56
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202303.2.0/ 400 KB
97 KB 21ms
19ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8e166157d90ed13492b8627e50c606aeab874cd0a5d6ed3b7c8a7988a3d46d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: Sw59qQKTUz8IJh2hCY03KQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB55BF34FA32B5
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 21940
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript
last-modified: Tue, 16 May 2023 03:39:51 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: c858a932-001e-0061-5119-2fd755000000
cf-ray: 8debcc4cfdc39761-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 98810
x-ms-blob-type: BlockBlob
server: cloudflare

POST
H/1.1 200
OK visitWebPage
001-vjx-104.mktoresp.com/webevents/ 2 B
318 B 891ms
156ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://001-vjx-104.mktoresp.com/webevents/visitWebPage?_mchNc=1730966514723&_mchCn=&_mchId=001-VJX-104&_mchTk=_mch-humansecurity.com-1730966514721-46016&_mchHo=www.humansecurity.com&_mchPo=&_mchRu=%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Transfer-Encoding: chunked
X-Request-Id: 7121e2d2-99da-4970-95b9-45f0244fd4b6
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Thu, 07 Nov 2024 08:01:55 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 sync
s.company-target.com/s/ Frame 3072 0
0 179ms
100ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.company-target.com/s/sync?exc=lr

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/1469bf09af802378.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

22.71.96.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Thu, 07 Nov 2024 08:01:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 115ms
26ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 07 Nov 2024 08:01:54 GMT

POST
H2 200 ip.json Show response
api.company-target.com/api/v3/ 486 B
1 KB 225ms
136ms XHR
application/json 18.66.102.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&page_title=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/1469bf09af802378.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.85 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-85.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

e2fb7e42abef5f1ceee56dda26597a5c65e3c490483384c34ea4d305248a09db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: 1c620c2e-93a3-4874-8558-05cf7230df09
expires: Wed, 06 Nov 2024 08:01:54 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: JvuWyvaCAmZt2AHqoJc4vifJEYxDdz4vPkS-YKrwXb926JXfaikEpQ==
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 4a502b22092e94faddf9a5b056e273ae.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.humansecurity.com
x-amz-cf-pop: FRA56-P2
server: nginx

POST
H2 204 view Show response
js.hs-banner.com/cookie-banner-public/v1/activity/ 0
197 B 137ms
113ms XHR
text/plain 2606:4700:4400::6812:28f0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/cookie-banner-public/v1/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/3400937.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 604800
x-request-id: 0fd071d2-8379-4e33-8c3d-4e724351a957
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cf-cache-status: DYNAMIC
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
date: Thu, 07 Nov 2024 08:01:55 GMT
x-hubspot-correlation-id: 0fd071d2-8379-4e33-8c3d-4e724351a957
vary: origin
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-drzrr
timing-allow-origin: *
x-envoy-upstream-service-time: 15
access-control-allow-credentials: true
cf-ray: 8debcc4e3a17d369-FRA
access-control-allow-origin: https://www.humansecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

OPTIONS
H2 200 view
js.hs-banner.com/cookie-banner-public/v1/activity/ Frame 0
0 166ms
117ms Preflight
application/octet-stream 2606:4700:4400::6812:28f0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.humansecurity.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 8debcc4d88d8d369-FRA
content-length: 0
content-type: application/octet-stream
date: Thu, 07 Nov 2024 08:01:54 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 1
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-8ghtt
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 448bb77e-3711-4718-949f-489159a6fd47
x-request-id: 448bb77e-3711-4718-949f-489159a6fd47

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 49 KB
15 KB 85ms
40ms Script
application/javascript 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=A2aW0Q==, md5=JRurSHzL3UB0yE1Wjm0Zqg==
cf-cache-status: DYNAMIC
etag: W/"251bab487ccbdd4074c84d568e6d19aa"
age: 3385
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Thu, 07 Nov 2024 08:05:29 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 50634
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript
last-modified: Wed, 06 Nov 2024 05:44:23 GMT
x-guploader-uploadid: AHmUCY0NXBuFFC_P6txW9lAMysLkfeq6kWVnCGcfXqAFqK1IqQ15Af2xeIU8IrvdiJJOvgU5fGi7h9Bc_A
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
cf-ray: 8debcc4e1a09d2d2-FRA
x-goog-generation: 1730871862939881
server: cloudflare

GET
H3 200 / Show response
ws.zoominfo.com/pixel/650492e79cc5e659a2211991/ 3 KB
2 KB 219ms
208ms Fetch
text/javascript 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/650492e79cc5e659a2211991/?iszitag=true

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

77b16a0a4d816c5aaf0c553637f9b15c6ec827adf8aaa32f924adf379d7d5562

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: 2b14cfea53a51d9e2dd91730966514
_vtok: NDUuMTQxLjE1Mi43Ng==
visited-url: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 8debcc4f2eafd2c2-FRA
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=86400
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: text/javascript
vary: Accept-Encoding
x-powered-by: Express
server: cloudflare
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/00f3a755-1fe4-4724-a84f-485fd8516370/ 66 KB
14 KB 36ms
36ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/00f3a755-1fe4-4724-a84f-485fd8516370/en.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b54028de37c84f4aeca11a73d1b1e1bd07de8ef2bc096281b432e497f9dd0ec9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: 6PLJEspOGyE/L+rXgCYpCg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DB8176530CBDC9
age: 38095
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 08 Nov 2024 08:01:54 GMT
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json
last-modified: Mon, 10 Jul 2023 18:49:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 463a7983-901e-00ce-204d-26f5c5000000
cf-ray: 8debcc4dea0d1d88-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14030
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 163 B
361 B 100ms
99ms XHR
text/plain 3.64.143.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=-dpn7vAs7ZeiRx2WE4D6Xw&is_js=true&landing_url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&t=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&tip=4yA3FXuZgbbfFI5WrDvKPcrPHzEuXX3SZr9YKj4A8Po&host=https%3A%2F%2Fwww.humansecurity.com&sa_conv_data_css_value=%270-0860521f-cbfc-5ec9-6269-906ff5c8e9b4%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90860521fcbfc5ec96269906ff5c8e9b42d8d984c&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQg8uexuQYwAToEQiu0oEIE5Vx83A.nOe2pV6scm3mFg6mDOqlUzthSuWfyCJ2eVPvL8zaZRk&sa-user-id-v2=s%253ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%252B0lT6DQInO0mJKcjUEU0&sa-user-id=s%253A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%252BiQQG%252F2%252BmOfhWwFrDYHRu5J1Y6x37A
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.64.143.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-64-143-177.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 92fa42c3c5bfc1e32f2979bd396d1002de3f8fdd454a487839c83025a20511d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.humansecurity.com
content-length: 163
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/650492e79cc5e659a2211991/ Frame 0
0 190ms
147ms Preflight
text/html 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/650492e79cc5e659a2211991/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.humansecurity.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8debcc4e1db49024-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 07 Nov 2024 08:01:55 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202303.2.0/assets/ 13 KB
3 KB 28ms
21ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.2.0/assets/otFlat.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa355c393e03f831dbdbcc678ba16396aab95930b1bc5b0549695d40cc955ca1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: pRHDWyQMLvXwKY458EnqRw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB55BF315FAED9
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 44957
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json
last-modified: Tue, 16 May 2023 03:39:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 857ecb37-101e-007e-782b-240c45000000
cf-ray: 8debcc4e8a911d88-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3019
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202303.2.0/assets/v2/ 61 KB
13 KB 25ms
19ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.2.0/assets/v2/otPcCenter.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: obw5M94dAr0Gi2p2lbQQ/g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB55BF32AEE4B7
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 8755
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json
last-modified: Tue, 16 May 2023 03:39:48 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d6f8cc22-301e-0069-7468-7900cf000000
cf-ray: 8debcc4e8a921d88-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12544
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202303.2.0/assets/ 21 KB
4 KB 29ms
23ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.2.0/assets/otCommonStyles.css

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c013d90ee202f7f0c56e4d0cacea4332b8437b6be5c25e5a449ca5ac6b0752e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: oWkBTLgDDXvrUsd93y/Zxg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status: unlocked
cf-bgj: minify
cf-cache-status: HIT
x-ms-version: 2009-09-19
age: 16269
content-encoding: gzip
x-content-type-options: nosniff
cf-polished: origSize=21608
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: text/css
last-modified: Tue, 16 May 2023 03:39:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 008b0490-e01e-0018-5d64-23e6e4000000
cf-ray: 8debcc4e8a931d88-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 402 KB
130 KB 28ms
28ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-59DHKRCY6M&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5ff97439b230379b021bfdad7be09cb6195fe5d2f14b92be430875786878964e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 07 Nov 2024 08:01:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 132554
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
419 B 450ms
380ms XHR
text/html 2600:9000:2724:e200:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=JvuWyvaCAmZt2AHqoJc4vifJEYxDdz4vPkS-YKrwXb926JXfaikEpQ==&api-version=v3
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/1469bf09af802378.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2724:e200:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 69245
x-cache: Error from cloudfront
x-amz-cf-id: UCmHHJxDxLktvMnCZxfKehpeapfYrhjvy6PHkgUY6pv7rz1JDG1eeA==
date: Wed, 06 Nov 2024 12:47:55 GMT
content-type: text/html
vary: accept-encoding
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
via: 1.1 7f26f4279546775ace8410d89a15a960.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: FRA56-P12
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 44 KB
4 KB 145ms
144ms Fetch
application/json 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

1274bb52feff24e5d53e0419178460c359db9d517b0a70513897080cac3bb920

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Authorization: bearer 3a88c8f1a27e4f0ec92016da0338ac
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"aea1-MvDcB06pANwGGtOJrRGl7dqG2Fk"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8debcc4f9f83d2c2-FRA
access-control-allow-origin: https://www.humansecurity.com
x-powered-by: Express
server: cloudflare

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 143ms
142ms Preflight
text/html 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.humansecurity.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8debcc4eae099024-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 07 Nov 2024 08:01:55 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H/1.1 200
OK ns Show response
stk.px-cloud.net/ 350 B
484 B 22ms
19ms XHR
text/html 34.107.199.61
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://stk.px-cloud.net/ns?c=8df12a80-9cde-11ef-8052-0dc683061f7b
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.107.199.61 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 61.199.107.34.bc.googleusercontent.com
Software: /
Resource Hash: dbccfae17fd9d1f31e7de3560396db9cc4f46a2bc3ea0de52bcc75d59cf64413

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Access-Control-Allow-Origin: *
Content-Length: 350
Date: Thu, 07 Nov 2024 08:01:54 GMT
Content-Type: text/html

POST
H2 200 collector Show response
collector-pxf69i9fy8.px-cloud.net/api/v2/ 484 B
540 B 172ms
154ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxf69i9fy8.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 006edd00c515f6628d03284d7e4236c3c2a07699763032a2ef1074691a414f0f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 484
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json; charset=utf-8

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
623 B 24ms
24ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 2084
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: image/svg+xml
last-modified: Wed, 06 Nov 2024 03:37:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: a3479182-501e-00fa-6237-305a6d000000
cf-ray: 8debcc4f5f8a9761-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
518 B 19ms
19ms Fetch
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 10022
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: image/svg+xml
last-modified: Wed, 06 Nov 2024 03:37:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d1a7aa3b-701e-004c-5408-305495000000
cf-ray: 8debcc4f6b541d88-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 HUMAN_logo_horiz_black.jpg
cdn.cookielaw.org/logos/bdc406fe-f273-4909-9374-53fa72f05678/f00e5254-ffda-4283-935d-86b9a91dc6c1/2bf04d17-0bd6-46fa-8a3b-648dbd5086cf/ 108 KB
108 KB 21ms
20ms Image
image/jpeg 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/bdc406fe-f273-4909-9374-53fa72f05678/f00e5254-ffda-4283-935d-86b9a91dc6c1/2bf04d17-0bd6-46fa-8a3b-648dbd5086cf/HUMAN_logo_horiz_black.jpg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31bffb649cd812a3e720b1838c910fe359aef60c46ec91149d895dc23708768d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: NhqNgvFSsXYG+FRFrroJLA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status: unlocked
cf-bgj: h2pri
etag: 0x8DB41D5282227E0
x-ms-version: 2009-09-19
cf-cache-status: HIT
age: 53666
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: image/jpeg
last-modified: Thu, 20 Apr 2023 19:26:36 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 35eb79a0-401e-0011-6ee9-5da337000000
cf-ray: 8debcc4f8fb29761-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 110133
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 28ms
28ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 5391
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: image/svg+xml
last-modified: Wed, 06 Nov 2024 03:37:03 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d5a456e4-d01e-0086-4770-30c758000000
cf-ray: 8debcc4f8fb39761-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 57ms
25ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-59DHKRCY6M&gtm=45je4au0v881684866z8830094232za200zb830094232&_p=1730966513913&gcs=G100&gcd=13p3p3p2p5l1&npa=1&dma_cps=-&dma=1&tag_exp=101823848~101925629&cid=397273522.1730966514&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=EA&_s=1&sid=1730966515&sct=1&seg=0&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&en=page_view&_fv=1&_ss=1&ep.timestamp=2024-11-07T09%3A01%3A54.973%2B01%3A00&ep.db_audience=Residential&ep.db_audience_segment=&tfd=2210
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.humansecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 p Show response
b.px-cdn.net/api/v1/PXf69I9fY8/d/ 421 B
663 B 53ms
16ms XHR
application/json 34.120.92.56
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://b.px-cdn.net/api/v1/PXf69I9fY8/d/p
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.92.56 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 56.92.120.34.bc.googleusercontent.com
Software: /
Resource Hash: 8acce610db5f9e90feb6108b0a44cd5fd8c291f6bbdf82fa2d757122bee06f40

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----------------qgno2vm84fk7fyfz
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,OPTIONS
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 421
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: application/json
access-control-allow-headers: authorization

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
611 B 156ms
134ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=3377520574&v=1.1&a=3400937&pi=172757353219&ct=blog-post&ccu=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&cpi=172757353219&cgi=5249379964&lpi=172757353219&lvi=172757353219&lvc=en-us&pu=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&t=Satori+Threat+Intelligence+Alert%3A+Konfety+Spreads+%E2%80%98Evil+Twin%E2%80%99+Apps+for+Multiple+Fraud+Schemes&cts=1730966515260&vi=fa064bb0af31a39a2b03d7a51f53bdc7&nc=true&ce=false&pt=1&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
x-request-id: 4f178f9b-6f00-47f5-8c5d-5eb1436e9379
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ldFPwos3SChPqwME9wrqWVoaTkTYZxAtHaDJK9WE7jd621peNp4A%2FZEd8Aw3t3l5PULjYzM%2BhiWyqADT31GtbtYRuXcT3XenYdaYI0vsFVMwSGOVegRpdFolwnxDNejOzGTiiAdnj5ZhrI7q19xl"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Thu, 07 Nov 2024 08:01:55 GMT
x-hubspot-correlation-id: 4f178f9b-6f00-47f5-8c5d-5eb1436e9379
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-746d57b5c6-qpwst
x-envoy-upstream-service-time: 6
access-control-allow-credentials: false
cf-ray: 8debcc5099149741-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H3 200 collect
www.google-analytics.com/ 35 B
58 B 10ms
10ms Image
image/gif 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1117056761&t=timing&_s=2&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&ul=de-de&de=UTF-8&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=2295&pdt=23&dns=33&rrt=1&srt=732&tcp=14&dit=1241&clt=1276&_gst=1033&_gbt=1280&_u=aHgAgAABAAAAAAAEKk~&cid=397273522.1730966514&tid=UA-111948466-2&_gid=703013032.1730966514&gtm=45He4au0n81KVP42DDv830094232za200&cd7=2024-11-07T09%3A01%3A53.990%2B01%3A00&cd8=4026ed49-e258-440a-97ed-ac594eaf4713&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma=1&tag_exp=101823848~101925629&cd3=397273522.1730966514&npa=1&z=1576236408

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

age: 60961
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 15:05:54 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H3 200 Human-Favicon-White-Black%20BKG.png
www.humansecurity.com/hubfs/ 10 KB
11 KB 41ms
41ms Other
image/webp 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hubfs/Human-Favicon-White-Black%20BKG.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

efa303262b36a12c1c28503edc4d8852388482855d729b169c9bfb1b969adf45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
cf-cache-status: HIT
etag: "90f1b1e31f9d8f952a7c9f1b72a4fad6"
age: 804500
cache-tag: F-84331736107,P-3400937,FLS-ALL
x-amz-version-id: AKHQlYFHnOtKub5LKdbjtfvMhkFcjFo4
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V2iUbG6rn%2FOrlRrqzxnEnrUknWn1EZVfzs0rI2iVa%2FqtEQ4Gs8xzZdhPjT7rNREw9dpk%2Fw6UZpZ%2BdwesHm3%2Bml2eSH%2Bs8AIJhmY0H29KYq709t5bsdLcuFwsh7e7KhwgPpSOKSx6t1FT4nO82TdiMa5TeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: BMMTweiZhN8rTPze7qf_c30EYE8pBoUh5T5_ddVOxjRT2oQGcsqVAw==
content-type: image/webp
content-disposition: inline; filename="Human-Favicon-White-Black%20BKG.webp"
last-modified: Fri, 27 Sep 2024 14:22:44 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-84331736107,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: GSNGRNF0A8A4PQK9
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-84331736107,P-3400937,FLS-ALL
content-length: 10100
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: origFmt=png, origSize=35632
date: Thu, 07 Nov 2024 08:01:55 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: qPZ9W8VQ5ZRVvY/Z7cZCCVsxDmP81cdq1Iot7G/ai4pElATqKcFx7srxHURvbjXvt20b7AWVmn6czPbUXiaEod/+S4d2LfHs
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 6f4aa26c09fb9bb4d152519f44256a4c.cloudfront.net (CloudFront)
cf-ray: 8debcc5098839104-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1662646750288

GET
BLOB 200
OK 9a0fcf91-fcb9-4255-9bbd-094a852af3e4 Show response
https://www.humansecurity.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.humansecurity.com/9a0fcf91-fcb9-4255-9bbd-094a852af3e4
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77b16a0a4d816c5aaf0c553637f9b15c6ec827adf8aaa32f924adf379d7d5562

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/javascript
Content-Length: 3457

POST
H2 200 collector Show response
collector-pxxdhgmtcm.px-cloud.net/api/v2/ 600 B
655 B 178ms
175ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxdhgmtcm.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 73d0cc70e189cb1df29c8052f22119d13270fe8e29f6ffd633d78591da1f8543

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
date: Thu, 07 Nov 2024 08:01:54 GMT
content-type: application/json; charset=utf-8

POST
H3 200 collector Show response
collector-pxf69i9fy8.px-cloud.net/api/v2/ 32 B
49 B 183ms
180ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxf69i9fy8.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: da6268d3e4ffd8edd34230feca29fa5a83e1562bd9cf623c05737ec3eea36871

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
date: Thu, 07 Nov 2024 08:01:55 GMT
content-type: application/json; charset=utf-8

GET undefined
www.humansecurity.com/learn/blog/ 0
0

GET
H2 200 footer.min.css
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115387395449/1693233183077/humansecurity-hs/assets/css/ 21 KB
4 KB 792ms
158ms Stylesheet
text/css 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115387395449/1693233183077/humansecurity-hs/assets/css/footer.min.css
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46043be637afe914e3a575c2921cd2904b2c4b59388128ed10625628402d46a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a066aa53-1f23-4dff-a856-1cf919371191
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b4d88ed60cd8e0f1e827de88fcfcc1e8"
age: 800168
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jcihO%2BrN0Z5XRwaXzEo1Y1C0NWUSMMLucNw3LvtHisHReGM1v0neMwGJd7z54tcNSQDY9JT3AspH4GJFZI%2B8PMAb8boF4AIvNUXkFvQlH6gqzXtQMPbmt9uuGdFxLcWrGLs%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: a066aa53-1f23-4dff-a856-1cf919371191
content-type: text/css
last-modified: Mon, 28 Aug 2023 14:33:04 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7bc58b7fb6-9fg76
x-envoy-upstream-service-time: 234
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:57 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8debcc607b993825-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1693233183807

POST
H2 200 p Show response
b.px-cdn.net/api/v1/PXf69I9fY8/d/ 3 B
57 B 39ms
34ms XHR
application/json 34.120.92.56
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://b.px-cdn.net/api/v1/PXf69I9fY8/d/p
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.92.56 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 56.92.120.34.bc.googleusercontent.com
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----------------hcfhhm43rv37f7iu
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,OPTIONS
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
date: Thu, 07 Nov 2024 08:01:57 GMT
content-type: application/json
access-control-allow-headers: authorization

GET
H2 200 fullcircle.js Show response
d2i34c80a0ftze.cloudfront.net/ 32 KB
11 KB 155ms
7ms Script
application/json 2600:9000:275b:1e00:9:14eb:6280:93a1

General

Check archive.org

Show headers Download Go to

Full URL

https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=c05754bf-2b15-4935-b7c4-cf576218c528&domain=humansecurity.com

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:275b:1e00:9:14eb:6280:93a1 -, , ASN (),

Reverse DNS

Software

Resource Hash

88e7b0718f584603ca29ed368567c07f629f1012e0e4972c3fd95db2e339504d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-amz-apigw-id: A2_u0EyIPHcEAvQ=
age: 11673
x-amzn-trace-id: Root=1-672c465e-1e79bc9a5a0c3d082a8e3163;Parent=51aca9c989e237c3;Sampled=0;Lineage=1:be50798f:0
x-amzn-requestid: 03eef095-6f43-4052-9d7c-f69bbde98689
via: 1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront), 1.1 dc929648f0c936ae1fcea0675ad0382c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: NvzYzp5Z_Z1ogF3p1xSijCR146JlsJUqcD37YChI35AY_ZeejT7s8A==
date: Thu, 07 Nov 2024 04:47:26 GMT
content-type: application/json
x-amz-cf-pop: FRA56-C1, FRA60-P7
vary: Accept-Encoding

GET
H2 200 app.js
acsbapp.com/apps/app/dist/js/ 380 KB
115 KB 286ms
139ms Script
application/javascript 2606:4700:10::ac43:b9b

General

Check archive.org

Show headers Download Go to

Full URL: https://acsbapp.com/apps/app/dist/js/app.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b9b -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-goog-metageneration: 3
access-control-expose-headers: *
x-goog-hash: crc32c=UFfPkQ==, md5=G8dxHFsInpMunGDC4OEp2Q==
cf-cache-status: REVALIDATED
etag: W/"1bc7711c5b089e932e9c60c2e0e129d9"
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Fri, 07 Nov 2025 08:01:59 GMT
x-goog-stored-content-length: 389507
date: Thu, 07 Nov 2024 08:01:59 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 06 Nov 2024 16:45:17 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY3iK9Hqy8Kc8ToV6urActoFBv6LPwjq5M02uKsbXDA8MtpY8QWRxguqaEuUTugWjdAYDOo
cache-control: public, max-age=300, must-revalidate
x-goog-storage-class: STANDARD
cf-ray: 8debcc69ef3dd291-FRA
access-control-allow-origin: *
x-goog-generation: 1730911517857344
server: cloudflare

GET
H2 200 body.min.css
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/99901597287/1721248587601/humansecurity-hs/assets/css/ 133 KB
21 KB 33ms
33ms Stylesheet
text/css 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/99901597287/1721248587601/humansecurity-hs/assets/css/body.min.css
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1892bc981117777e575dc1231631c473cc8b57fd0d023c5e883978d5256a85ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 791e99e9-7407-427a-af89-adc15e855015
content-encoding: gzip
cf-cache-status: HIT
etag: W/"133efba53ade4b7f1ba3a07bcea5eca9"
age: 1030367
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cEI0RATnmZFZbn7sNrABhYyYFshvQIpz70IG5nfrPWYiXx%2FBG7QX9npCdI6BJkJ3WjOmohmjdcawpKMYOz7gl7XWjFwggHmHiegizvU%2B3ucAO%2B5lMahAjojb4CMX1f4a75w%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 791e99e9-7407-427a-af89-adc15e855015
content-type: text/css
last-modified: Wed, 17 Jul 2024 20:36:29 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7bc58b7fb6-9fg76
x-envoy-upstream-service-time: 179
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:59 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8debcc690ac13825-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1721248588873

GET
H2 200 jquery.magnificpopup.min.js Show response
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656499996/1698698454228/humansecurity-hs/punch/assets/js/dist/ 20 KB
8 KB 30ms
30ms Script
application/javascript 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656499996/1698698454228/humansecurity-hs/punch/assets/js/dist/jquery.magnificpopup.min.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a123eebd3f1e4f9b4641216ddc8aee3dd0ecc035cc9d2f6ed7b92c979fccc326

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 17a489e6-f64b-4e24-95bf-348115000181
content-encoding: br
cf-cache-status: HIT
etag: W/"23546b2633cc3b557bb3a13ac0d1c719"
age: 2454321
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pRcosPLQoD4epDGZksJlgYKombzyY8Rz1NQHXM%2FzgxPpbdLyYI3Nwfkc26BD8k3JS2DeY6gRulxx1Zgnf7PKrPnfwKUigrSlrB9NIOghT8fhUjPjIoa7aNv3SiZXTsQomdU%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 17a489e6-f64b-4e24-95bf-348115000181
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:55 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64786dc485-k5lvm
x-envoy-upstream-service-time: 214
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:59 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8debcc690ac33825-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698454685

GET
H2 200 lightbox-combo.min.js Show response
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115294898870/1698698465768/humansecurity-hs/punch/assets/js/dist/ 24 KB
9 KB 32ms
32ms Script
application/javascript 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115294898870/1698698465768/humansecurity-hs/punch/assets/js/dist/lightbox-combo.min.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54922aed651f983596d7c4d47b075f10dfa004fffe6c60c15c59ecdc1856529f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: dc6a0cdb-bd75-43a4-a9f9-4fd2db7504a3
content-encoding: br
cf-cache-status: HIT
etag: W/"687a6f388e56976362f732fa3410027c"
age: 1028462
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=embteKLy3cDZQ31uXLSEhzDEmP%2FNW0X80HIsFA%2F3Z4ECjfIQ1rVmQgiqUyk8V3CRDzn63DoITbmgrgC76C5l7cRBwhAS%2FI86bux8dxAlbaeW0YwLTgu17AUXsSVyOkgBQUM%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: dc6a0cdb-bd75-43a4-a9f9-4fd2db7504a3
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:41:07 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-4f62g
x-envoy-upstream-service-time: 132
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:59 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8debcc690ac43825-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698466182

GET
H2 200 flickity-combo.min.js Show response
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656625716/1698698450031/humansecurity-hs/punch/assets/js/dist/ 67 KB
18 KB 37ms
37ms Script
application/javascript 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656625716/1698698450031/humansecurity-hs/punch/assets/js/dist/flickity-combo.min.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d3b1eb7d0f0f9f6b02dc4d100a34d5ed61b9b22e284ef8b8fc16dee56cb0453

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: e37a9e46-243b-4ac4-99d0-b5a8185f7898
content-encoding: br
cf-cache-status: HIT
etag: W/"0b1204d9265290f1b3d4250e491d06dd"
age: 1114092
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fp3RZiy9iX%2BBSghmrUEyYW%2BqL4p1kjP19kQ7TrVg0H3kU4CrrLcMPlHnl37o%2FJro%2BCRQKsohn131ibUW6YDfIkZt0EsveRMHU8DLhjqwiA9WlHwX3avEH2XyRf9b%2FYKq0Kw%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: e37a9e46-243b-4ac4-99d0-b5a8185f7898
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:51 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-8lkkj
x-envoy-upstream-service-time: 204
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Thu, 07 Nov 2024 08:01:59 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8debcc690ac53825-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698450553

POST create
st.fullcircleinsights.com/v1/visitors/ 0
0

OPTIONS
H2 200 create
st.fullcircleinsights.com/v1/visitors/ Frame 0
0 228ms
149ms Preflight
application/json 13.224.189.101

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: js-version,origin-fci,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: https://www.humansecurity.com
content-length: 1
content-type: application/json
date: Thu, 07 Nov 2024 08:01:59 GMT
via: 1.1 69f13f852a135432abb1b7bfc5a8b420.cloudfront.net (CloudFront)
x-amz-apigw-id: A3cOvFCzPHcEFKg=
x-amz-cf-id: JIR5Lnb6nhQ_eyTVViT-WIxSS_5vWS_O790eOnKanOygk7QULURi5A==
x-amz-cf-pop: FRA2-C1
x-amzn-requestid: 04f4fc5b-6d0e-4711-b919-0ef7d5a89d51
x-cache: Miss from cloudfront

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bat.bing.com
URL: https://bat.bing.com/bat.js

Domain: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/undefined

Domain: st.fullcircleinsights.com
URL: https://st.fullcircleinsights.com/v1/visitors/create

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

35 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.humansecurity.com/	1970-01-21 00:49:28	Name: __cf_bm Value: a6KQGyyvhKzK42YTgp9CaD86ZsDQnW2OI37y0aoMggY-1730966513-1.0.1.1-oSCwhkiYW4rWyUq49jxnc57HWjB6uc61OFYlMFI_yEKMbxD9bDGfwbvH82FMAENL.PichF7u_0fdAgJ.Ot_xkw
.www.humansecurity.com/	1969-12-31 23:59:59	Name: __cfruid Value: e25a41bb89d5d5585ac8e415cc78dd72e97b13b6-1730966513
tags.srv.stackadapt.com/	1970-01-21 09:35:02	Name: sa-user-id Value: s%3A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%2BiQQG%2F2%2BmOfhWwFrDYHRu5J1Y6x37A
.srv.stackadapt.com/	1970-01-21 09:35:02	Name: sa-user-id Value: s%3A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%2BiQQG%2F2%2BmOfhWwFrDYHRu5J1Y6x37A
tags.srv.stackadapt.com/	1970-01-21 09:35:02	Name: sa-user-id-v2 Value: s%3ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%2B0lT6DQInO0mJKcjUEU0
.srv.stackadapt.com/	1970-01-21 09:35:02	Name: sa-user-id-v2 Value: s%3ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%2B0lT6DQInO0mJKcjUEU0
tags.srv.stackadapt.com/	1970-01-21 09:35:02	Name: sa-user-id-v3 Value: s%3AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQg8uexuQYwAToEQiu0oEIE5Vx83A.nOe2pV6scm3mFg6mDOqlUzthSuWfyCJ2eVPvL8zaZRk
.srv.stackadapt.com/	1970-01-21 09:35:02	Name: sa-user-id-v3 Value: s%3AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQg8uexuQYwAToEQiu0oEIE5Vx83A.nOe2pV6scm3mFg6mDOqlUzthSuWfyCJ2eVPvL8zaZRk
.g2crowd.com/	1970-01-21 00:49:28	Name: __cf_bm Value: vMqMY7K7KUnj0N5F.ztmhCnEp285GV2JpBlI1l.qmSc-1730966514-1.0.1.1-Udld_beu0VFZRyXMAecXfx2O7nacmPp.43BUwadoYSwG7BF1h2m9Lb7sqZTkdveuuCIKMhH98vHpeq9RZDOipA
.hubspot.com/	1970-01-21 00:49:28	Name: __cf_bm Value: XQQc_e3aTtEU_1rstGdzc9wlCMX09KdwyD5qjE2p_hk-1730966514-1.0.1.1-i8XffujZQKnAGKZdXtM_FP4wbd16vpE.GR5fV27lmwr5YXJhDBDQXqqanYxmWKSjCESHTte3FAkiSujfOXNdMg
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: vFwo9z3ihH8XOdOqmabmgz_TNCdmrbSxJHcOnIzZ_oQ-1730966514377-0.0.1.1-604800000
www.humansecurity.com/	1970-01-21 09:35:02	Name: sa-user-id Value: s%253A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%252BiQQG%252F2%252BmOfhWwFrDYHRu5J1Y6x37A
www.humansecurity.com/	1970-01-21 09:35:02	Name: sa-user-id-v2 Value: s%253ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%252B0lT6DQInO0mJKcjUEU0
www.humansecurity.com/	1970-01-21 09:35:02	Name: sa-user-id-v3 Value: s%253AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQg8uexuQYwAToEQiu0oEIE5Vx83A.nOe2pV6scm3mFg6mDOqlUzthSuWfyCJ2eVPvL8zaZRk
.humansecurity.com/	1970-01-21 09:35:02	Name: _hjSessionUser_3389720 Value: eyJpZCI6Ijc2ZmI2NTFhLTNjZDUtNTY3NC05ODBiLWYyMDhhOTJmNTYzOCIsImNyZWF0ZWQiOjE3MzA5NjY1MTQ1NjEsImV4aXN0aW5nIjp0cnVlfQ==
.linkedin.com/	1970-01-21 09:35:02	Name: bcookie Value: "v=2&0cf29894-e6aa-4819-8b89-b6190cff42c1"
.linkedin.com/	1970-01-21 05:08:38	Name: li_gc Value: MTswOzE3MzA5NjY1MTQ7MjswMjFw1gR7FnC41BxgCpLfhgKyt7BX1fnCDSgH88D+6+YRuQ==
.linkedin.com/	1970-01-21 00:50:52	Name: lidc Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2975:u=1:x=1:i=1730966514:t=1731052914:v=2:sig=AQHmCqoKhBmjUJnbnKSJq65xNuswAi7q"
.humansecurity.com/	1970-01-21 00:49:28	Name: _hjSession_3389720 Value: eyJpZCI6ImU2YTNmYjZlLWI4NmItNDVkMi04NmJlLTU2NjliMzcwOTJlOCIsImMiOjE3MzA5NjY1MTQ1NjYsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.humansecurity.com/	1969-12-31 23:59:59	Name: pxcts Value: 8dade87e-9cde-11ef-80b2-24be7470b447
.humansecurity.com/	1970-01-21 09:35:02	Name: _pxvid Value: 8dadde43-9cde-11ef-80b2-dd2e0bca5e9c
.humansecurity.com/	1970-01-21 10:25:26	Name: _mkto_trk Value: id:001-VJX-104&token:_mch-humansecurity.com-1730966514721-46016
.www.humansecurity.com/	1970-01-21 09:35:02	Name: _zitok Value: 2b14cfea53a51d9e2dd91730966514
.company-target.com/	1970-01-21 10:25:26	Name: tuuid Value: 9e9134fa-59ea-41c1-9298-e00f2461f6bb
.company-target.com/	1970-01-21 10:25:26	Name: tuuid_lu Value: 1730966514\|ix:0\|mctv:0\|rp:0
.zoominfo.com/	1970-01-21 00:49:28	Name: __cf_bm Value: pKiG9vepDAraPWhYmQ7Y_VIxRoXT.98uzSQeDlouIV0-1730966514-1.0.1.1-FOlgob7hxWmNaamZOr05rL1CJn_SXaOL32mqPjzi6ri8uxmuuPsCubfeL.cYpRBbvwvwUiykDfVMjiAfvWJ47Q
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: PUleZAfoqgwUlFYk8WUZ_tu8diG55qOX1Xk0dGXU.Uo-1730966514916-0.0.1.1-604800000
.casalemedia.com/	1970-01-21 09:35:02	Name: CMID Value: Zyxz8lVbLLQAAEcHAV8SQQAA
.casalemedia.com/	1970-01-21 02:59:02	Name: CMPS Value: 3338
.casalemedia.com/	1970-01-21 02:59:02	Name: CMPRO Value: 3338
.www.humansecurity.com/	1970-01-21 09:35:02	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+Nov+07+2024+09%3A01%3A55+GMT%2B0100+(Mitteleurop%C3%A4ische+Normalzeit)&version=202303.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&groups=C0004%3A0%2CC0003%3A0%2CBG44%3A0%2CC0001%3A1%2CC0002%3A0
www.humansecurity.com/	1970-01-21 09:35:02	Name: _pxvid Value: 8e063f37-9cde-11ef-859d-e5c7f13c89ba
.tremorhub.com/	1970-01-21 09:35:23	Name: tvid Value: 961e218182d9436b901fd0860e537ffb
.tremorhub.com/	1970-01-21 10:25:26	Name: tv_UIDM Value: 9e9134fa-59ea-41c1-9298-e00f2461f6bb
.humansecurity.com/	1970-01-21 09:36:28	Name: __pxvid Value: 8e1be5f0-9cde-11ef-b24b-0242ac120003

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bat.bing.com/bat.js Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

001-vjx-104.mktoresp.com
acsbapp.com
api.company-target.com
app.hubspot.com
b.px-cdn.net
bat.bing.com
cdn.cookielaw.org
cdn2.hubspot.net
cdnjs.cloudflare.com
client.px-cloud.net
collector-pxf69i9fy8.px-cloud.net
collector-pxxdhgmtcm.px-cloud.net
connect.facebook.net
content.hotjar.io
d2i34c80a0ftze.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
id.rlcdn.com
js.hs-analytics.net
js.hs-banner.com
js.hsleadflows.net
js.zi-scripts.com
munchkin.marketo.net
pagead2.googlesyndication.com
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
s.cdnsynd.com
s.company-target.com
script.hotjar.com
snap.licdn.com
st.fullcircleinsights.com
static.hotjar.com
static.hsappstatic.net
stk.px-cloud.net
tag-logger.demandbase.com
tag.demandbase.com
tags.srv.stackadapt.com
track.hubspot.com
tracking.g2crowd.com
ws-assets.zoominfo.com
ws.zoominfo.com
www.google-analytics.com
www.googletagmanager.com
www.humansecurity.com
bat.bing.com
st.fullcircleinsights.com
www.humansecurity.com
104.102.43.106
104.18.37.212
104.18.89.62
108.128.38.51
13.107.42.14
13.224.189.101
13.32.27.19
146.75.120.157
18.245.46.44
18.66.102.53
18.66.102.85
192.28.147.68
2001:4860:4802:34::36
2600:9000:2724:e200:1d:8d6d:3b40:93a1
2600:9000:275b:1e00:9:14eb:6280:93a1
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:2c40::c73c:67e3
2606:4700:10::ac43:b9b
2606:4700:4400::6812:28f0
2606:4700:4400::ac40:9b77
2606:4700::6810:752b
2606:4700::6810:762b
2606:4700::6810:7674
2606:4700::6811:180e
2606:4700::6811:ad5b
2606:4700::6811:afc9
2606:4700::6812:1fb0
2606:4700::6812:572a
2606:4700::6812:8911
2620:1ec:21::14
2a00:1450:4001:802::200a
2a00:1450:4001:803::200e
2a00:1450:4001:806::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82f::2008
2a02:26f0:3500:10::210:a9a
2a02:26f0:480:33::212:40d0
2a03:2880:f083:100:face:b00c:0:3
3.252.225.231
3.64.143.177
34.107.199.61
34.120.92.56
34.96.71.22
35.190.10.96
35.244.174.68
006edd00c515f6628d03284d7e4236c3c2a07699763032a2ef1074691a414f0f
02a711f90cf3fe3f3c91c838aa383dd9bc60d67b59e678328975e2193c1ce1d1
0d3b1eb7d0f0f9f6b02dc4d100a34d5ed61b9b22e284ef8b8fc16dee56cb0453
126e07fe4635bb161e3cef3e0041dac87c8eb4bf390878de83077a7244a5a3ae
1274bb52feff24e5d53e0419178460c359db9d517b0a70513897080cac3bb920
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
17d527904615bb8d02f2fb91dd08227f626f5ba0aab65d6a820f2eb60fb2c673
1892bc981117777e575dc1231631c473cc8b57fd0d023c5e883978d5256a85ae
201b591d8778f953b5cde276d197d939dbc151d21e948d0e91d8869901f9eeb8
27d001801da9af0f66dfdc4b42a2a22ef3c91682ec36157d1e38c9c75e16bef6
2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254
2ce3ba4409684c6edb3a5aab2327b8d6eede74b6ab867ed011d7eb75ff095601
2fc92a4b6bcd0e8fdd8b4939e421646379410fc25266f0fb5f1abf07a843f93e
31bffb649cd812a3e720b1838c910fe359aef60c46ec91149d895dc23708768d
339f56eb998936df93ed5a98b9bb3f6befdf999fda731e9e2d152d49d3e828a0
3e96e51bce41e61ed84d7d3bd61411f019a3098dfeaf2230a5a948ee2431471e
42c7e51d284cd7256caf3bfebf641141876657ea0d6e5588ac7e69dce1e9cf7e
439042e0204db71db38bb4cbe130c3e520d35a14c2d9f65200308eaf1886eb64
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46043be637afe914e3a575c2921cd2904b2c4b59388128ed10625628402d46a6
51dc7dc0230a49f9165be029ce8209574533ac04b2c617b62c06250684e154a2
521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc
54922aed651f983596d7c4d47b075f10dfa004fffe6c60c15c59ecdc1856529f
54a00c1f0eaaeb0537a8297cda238d8d96c0441a708ebaba46e4f473ac94e689
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f
5db7ebaf5c59a393c37e60c30e2d80c32e24cd7b49c02e04a14e10bd4a3e31b3
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5ff97439b230379b021bfdad7be09cb6195fe5d2f14b92be430875786878964e
632ae2a19dd0817549172e38d37d628124c089c4466c0dca78378c8a78e3f1e1
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
671367c3c0e84517f31e61945cd9ba416f89eb653dbc3c4d1828518ef5c627e7
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6da34af8a0423529c070242c7a9582fc4ef2b0458c12f7077d4b18303bb0e6a1
6f684971a6600c115bd3d3102c43a0b09ad5a1a3c45a818269445ba888ce8d58
7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d
73d0cc70e189cb1df29c8052f22119d13270fe8e29f6ffd633d78591da1f8543
77b16a0a4d816c5aaf0c553637f9b15c6ec827adf8aaa32f924adf379d7d5562
78142c1a0831423d3fee5308b442b24659445ac8d7c34b92bde6624cc012f4e8
7bfe0695ae8a623e3bfb51affa85f41a5593014633878b4489b449d3a37a444b
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
7ffc1868d47d7489ff07ede07129c607fe3f3cc2b2087cc62a666369f9851033
81f2e0a9e0cbb9cfcb5d72f56f4eff056370ddd14104251fc7066a8f7d641828
8320299532b4b81498d5b3714d49c9d5938883b55f4c2a1efe6f105bf4a942bd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
88e7b0718f584603ca29ed368567c07f629f1012e0e4972c3fd95db2e339504d
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8acce610db5f9e90feb6108b0a44cd5fd8c291f6bbdf82fa2d757122bee06f40
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
92cde36d24b66c5bb39231c290e47319cc207455557a1c4ddf0b1c584422db77
92fa42c3c5bfc1e32f2979bd396d1002de3f8fdd454a487839c83025a20511d6
95076e36507eefb60c3eaf68ca46ec93f299a654adc79633d68d56f33ec22869
9c013d90ee202f7f0c56e4d0cacea4332b8437b6be5c25e5a449ca5ac6b0752e
9cac5e10bd3d5631c178a838d415c28b126daca61e10e81e6dc36aa18919174f
a123eebd3f1e4f9b4641216ddc8aee3dd0ecc035cc9d2f6ed7b92c979fccc326
a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d
aa355c393e03f831dbdbcc678ba16396aab95930b1bc5b0549695d40cc955ca1
adfc35d72ea1d0feaa677acecd2dafad7fdda56b02a76d7f51ad1bc067c2d499
afff892691aaab5f3a2c411cb09a2674006120f314eb8ac1fc6efb8c66a1c353
b0392294081a8113d3c077796594484f5354ebb23b518d3337738015bddb70aa
b17ad6eab5f71934277721a0558d12da27ef1c1d7688d3dc8e8440165902526b
b54028de37c84f4aeca11a73d1b1e1bd07de8ef2bc096281b432e497f9dd0ec9
b84398de46283985db9507da817ab6fd1c66687b7b9f6d1bf3e0de29bc2b3e28
bcd54b12a92c0c934aaea3dd9b81344714308f128b0d84b6455b25636946dd9d
bd2553bf53cd2bf7e6e0c1ef7ef0aa7b85098dbf74956ddc5057ed5725e4957b
be99b037586f1d31100f6205fb7650348bc715c0091a5495c3cb8ad8a3145ef4
c07c809080e9588aca7e98461b0b28f6df1ddc0333efc1876e35a65f0e9da999
c4aed508cef0dec6f9ba089beac48f831d4d6cf91020518e6290b4b262434f21
c564b7cedb11c28a97fe8292fc8d20bf6b8e0ede52994d80f55c7c8a082c6700
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522
d44882ab82adeef2856a0d52fb54bb70e472be45d50aa3a16b4cb39223391a99
d4a42e8f77ed647b32311ffc6b611bdc77b6296726e51cfc958ac736c63a6654
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
d5ea4cc18382ea8b4bab715faf7d7e79780f7b49e4b5b4e24bed6161d58cd9b6
d651066ec06c641549632f4776b2cdbf638ca0786adf1c58f44a2728daed9b00
d8e166157d90ed13492b8627e50c606aeab874cd0a5d6ed3b7c8a7988a3d46d3
da6268d3e4ffd8edd34230feca29fa5a83e1562bd9cf623c05737ec3eea36871
dbccfae17fd9d1f31e7de3560396db9cc4f46a2bc3ea0de52bcc75d59cf64413
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2
dd5e60442181c68a2711c4a407db551e51e0af167f16b86775ceb7e56679a045
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0d54140c9e5b41f4f5f8fd5583a8ae657452e2bec968966ab70c26d5ae77719
e23ebe6f2b292295569499333c48a8fd2d129cf77951a74eafc324b707720993
e2fb7e42abef5f1ceee56dda26597a5c65e3c490483384c34ea4d305248a09db
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
ef5bd244dd1e8de8413bf166a3b1a4cc37bb7fba87a547001622086b5fcc05fb
efa303262b36a12c1c28503edc4d8852388482855d729b169c9bfb1b969adf45
f0a9b19d1615e0e2afdca507d4c7cbe384b0bdfad5cbaf63c14a386df33a62d7
f72f1ba055250d787ae6b4adbfb82f5bce37fb21837391da42fc4268e1213fcb
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.humansecurity.com Open in urlscan Pro 2606:2c40::c73c:67e3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

121 Requests

96 %HTTPS

58 %IPv6

37 Domains

48 Subdomains

46 IPs

4 Countries

2121 kBTransfer

6083 kBSize

35 Cookies

17 Outgoing links

Redirected requests

121 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.humansecurity.com Open in urlscan Pro
2606:2c40::c73c:67e3 Public Scan

Screenshot
Live screenshot

Full Image

121
Requests

96 %
HTTPS

58 %
IPv6

37
Domains

48
Subdomains

46
IPs

4
Countries

2121 kB
Transfer

6083 kB
Size

35
Cookies

121 HTTP transactions
3 data transactions