cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Submission: On July 23 via api (July 23rd 2020, 7:39:28 am UTC) from DE

Summary HTTP 91 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 34 IPs in 7 countries across 30 domains to perform 91 HTTP transactions. The main IP is 35.188.168.180, located in United States and belongs to GOOGLE, US. The main domain is cofense.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 31st 2020. Valid for: 3 months.

This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
32	35.188.168.180 35.188.168.180	15169 (GOOGLE) (GOOGLE)
5	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
7	2a00:1450:400... 2a00:1450:4001:81e::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:2000:c:d51b:4400:21	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
2	143.204.202.100 143.204.202.100	16509 (AMAZON-02) (AMAZON-02)
7	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	54.197.98.98 54.197.98.98	14618 (AMAZON-AES) (AMAZON-AES)
1	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
2	147.75.102.197 147.75.102.197	54825 (PACKET) (PACKET)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:eb:... 2a02:26f0:eb:3b3::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	34.230.159.139 34.230.159.139	14618 (AMAZON-AES) (AMAZON-AES)
1	23.111.11.83 23.111.11.83	33438 (HIGHWINDS2) (HIGHWINDS2)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	104.16.168.82 104.16.168.82	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.22.109.130 52.22.109.130	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:821::2002	15169 (GOOGLE) (GOOGLE)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.35.254.73 13.35.254.73	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1 2	2a00:1450:400... 2a00:1450:4001:817::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	147.75.33.233 147.75.33.233	54825 (PACKET) (PACKET)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	107.20.140.231 107.20.140.231	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1	54.194.207.225 54.194.207.225	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE)
1 2	3.85.187.26 3.85.187.26	14618 (AMAZON-AES) (AMAZON-AES)
2	35.174.151.106 35.174.151.106	14618 (AMAZON-AES) (AMAZON-AES)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
91	34

32 35.188.168.180 (United States)

ASN15169 (GOOGLE, US)
PTR: 180.168.188.35.bc.googleusercontent.com

cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:81e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:2000:c:d51b:4400:21 (United States)

ASN16509 (AMAZON-02, US)

dsms0mj1bbhn4.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.100 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-100.fra53.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (Dallas, United States)

ASN20446 (HIGHWINDS3, US)

m9m6e2w5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.197.98.98 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-197-98-98.compute-1.amazonaws.com

www.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.130 (Mountain View, United States)

ASN15169 (GOOGLE, US)

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.75.102.197 (Central, Hong Kong)

ASN54825 (PACKET, US)

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:eb:3b3::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.230.159.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

t.sf14g.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.83 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.optnmstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.168.82 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.109.130 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

analytics.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.254.73 (Seattle, United States)

ASN16509 (AMAZON-02, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.33.233 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.140.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partner.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9d (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.194.207.225 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.85.187.26 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

tracking.leadlander.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.151.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	cofense.com cofense.com	2 MB
8	googleapis.com fonts.googleapis.com ajax.googleapis.com	12 KB
7	gstatic.com fonts.gstatic.com	109 KB
5	fontawesome.com use.fontawesome.com	186 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	91 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	google-analytics.com www.google-analytics.com	46 KB
2	pardot.com pi.pardot.com	4 KB
2	leadlander.com 1 redirects tracking.leadlander.com	423 B
2	facebook.com www.facebook.com	363 B
2	google.de www.google.de	213 B
2	google.com 1 redirects www.google.com	302 B
2	doubleclick.net 1 redirects googleads.g.doubleclick.net stats.g.doubleclick.net	1 KB
2	shareaholic.com analytics.shareaholic.com partner.shareaholic.com	641 B
2	facebook.net connect.facebook.net	165 KB
2	bing.com bat.bing.com	8 KB
2	driftt.com js.driftt.com	45 KB
2	googletagmanager.com www.googletagmanager.com	84 KB
1	twitter.com analytics.twitter.com	650 B
1	t.co t.co	448 B
1	omappapi.com api.omappapi.com	17 KB
1	zoominfo.com ws.zoominfo.com	723 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	optnmstr.com a.optnmstr.com	59 KB
1	sf14g.com t.sf14g.com	37 KB
1	licdn.com snap.licdn.com	2 KB
1	googleadservices.com www.googleadservices.com	11 KB
1	shareaholic.net www.shareaholic.net	2 KB
1	stackpathcdn.com m9m6e2w5.stackpathcdn.com	40 KB
1	cloudfront.net dsms0mj1bbhn4.cloudfront.net	4 KB
91	30

	Domain	Requested by
32	cofense.com	cofense.com
7	fonts.gstatic.com	cofense.com ajax.googleapis.com
7	fonts.googleapis.com	cofense.com ajax.googleapis.com
5	use.fontawesome.com	cofense.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com cofense.com
2	pi.pardot.com	cofense.com pi.pardot.com
2	tracking.leadlander.com	1 redirects cofense.com
2	www.facebook.com	cofense.com connect.facebook.net
2	www.google.de	cofense.com
2	www.google.com	1 redirects cofense.com
2	px.ads.linkedin.com	1 redirects cofense.com
2	connect.facebook.net	cofense.com connect.facebook.net
2	bat.bing.com	www.googletagmanager.com cofense.com
2	js.driftt.com	cofense.com js.driftt.com
2	www.googletagmanager.com	cofense.com
1	analytics.twitter.com	static.ads-twitter.com
1	ajax.googleapis.com	a.optnmstr.com
1	in.hotjar.com	script.hotjar.com
1	stats.g.doubleclick.net	1 redirects
1	partner.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	vars.hotjar.com	static.hotjar.com
1	t.co	cofense.com
1	api.omappapi.com	a.optnmstr.com
1	script.hotjar.com	static.hotjar.com
1	www.linkedin.com	1 redirects
1	googleads.g.doubleclick.net	www.googleadservices.com
1	analytics.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	ws.zoominfo.com	cofense.com
1	static.ads-twitter.com	cofense.com
1	a.optnmstr.com	cofense.com
1	t.sf14g.com	cofense.com
1	snap.licdn.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.shareaholic.net	dsms0mj1bbhn4.cloudfront.net
1	m9m6e2w5.stackpathcdn.com	dsms0mj1bbhn4.cloudfront.net
1	dsms0mj1bbhn4.cloudfront.net	cofense.com
91	37

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
community.cofense.com
cofenselabs.com
developer.cofense.com
go.cofense.com
www.infosecurity-magazine.com
www.ftadviser.com
www.techradar.com
www.scmagazine.com
www.wpdownloadmanager.com

Subject Issuer	Validity	Valid
cofense.com Let's Encrypt Authority X3	`2020-05-31` - `2020-08-29`	3 months	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-06-30` - `2020-09-22`	3 months	crt.sh
drift.com Amazon	`2019-10-03` - `2020-11-03`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-06-30` - `2020-09-22`	3 months	crt.sh
*.stackpathcdn.com Go Daddy Secure Certificate Authority - G2	`2019-06-27` - `2021-06-27`	2 years	crt.sh
*.shareaholic.net Let's Encrypt Authority X3	`2020-06-28` - `2020-09-26`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-06-30` - `2020-09-22`	3 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-06-17` - `2020-09-15`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-05-14` - `2020-08-05`	3 months	crt.sh
t.sf14g.com Go Daddy Secure Certificate Authority - G2	`2019-07-09` - `2020-09-07`	a year	crt.sh
*.optnmstr.com Go Daddy Secure Certificate Authority - G2	`2018-12-13` - `2020-12-13`	2 years	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh
shareaholic.com Amazon	`2020-07-03` - `2021-08-03`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-03-04` - `2020-09-04`	6 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-06-18` - `2020-09-16`	3 months	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-06-30` - `2020-09-22`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-06-16` - `2020-09-14`	3 months	crt.sh
*.shareaholic.com Let's Encrypt Authority X3	`2020-06-28` - `2020-09-26`	3 months	crt.sh
*.hotjar.com Amazon	`2019-09-27` - `2020-10-27`	a year	crt.sh
*.leadlander.com Go Daddy Secure Certificate Authority - G2	`2020-04-28` - `2022-04-28`	2 years	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2019-12-26` - `2020-12-26`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Frame ID: 7E0409AB574847B9B93707EE1014D3C6
Requests: 89 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: E8A81EC454112FE4045A1D1FC7C7CC92
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: BF7D25C7D72BE30357B2519BC5CB016E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

91
Requests

100 %
HTTPS

44 %
IPv6

30
Domains

37
Subdomains

34
IPs

7
Countries

2642 kB
Transfer

6897 kB
Size

1
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/cofense

Search URL Search Domain Scan URL

URL: https://twitter.com/cofense

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/11500065/

Search URL Search Domain Scan URL

URL: https://community.cofense.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://cofenselabs.com/
Title: Cofense Labs

Search URL Search Domain Scan URL

URL: https://developer.cofense.com/
Title: Cofense Dev

Search URL Search Domain Scan URL

URL: https://go.cofense.com/live-demo/
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/&title=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links&source=https://cofense.com
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links&url=https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/&via=cofense
Title:

Search URL Search Domain Scan URL

URL: https://www.infosecurity-magazine.com/news/confense-hmrc-covid-tax-scam/
Title: 15-July-2020Cofense Detects HMRC #COVID19 Tax Relief Scam InfoSecurity

Search URL Search Domain Scan URL

URL: https://www.ftadviser.com/investments/2020/07/15/ia-warns-of-large-scale-investment-scam/?page=1
Title: 15-Jul-2020IA warns of large-scale investment scam FT Adviser

Search URL Search Domain Scan URL

URL: https://www.techradar.com/news/phishing-links-hidden-inside-calendar-invite-attachments
Title: 1-July-2020Phishing links hidden inside calendar invite attachments Techradar Pro

Search URL Search Domain Scan URL

URL: https://www.scmagazine.com/home/security-news/event-invitation-phishing-scheme-usurps-efficacy-of-microsoft-google-and-wells-fargo/
Title: 29-June-2020Event invitation phishing scheme usurps efficacy of Microsoft, Google and Wells Fargo SC Media

Search URL Search Domain Scan URL

URL: http://www.wpdownloadmanager.com/
Title: WordPress Download Manager - Best Download Management Plugin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&time=1595489945780 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26url%3Dhttps%253A%252F%252Fcofense.com%252Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%252F%26time%3D1595489945780%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&time=1595489945780&liSync=true

Request Chain 78

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&gjid=1312595949&_gid=1826815700.1595489946&_u=aGDAgUADQ~&z=1062360251 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&_v=j83&z=1062360251 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&_v=j83&z=1062360251&slf_rd=1&random=1690961931

Request Chain 82

https://tracking.leadlander.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&referer=&fp=f10d44237416b9907b2c88ae232a9574 HTTP 302
https://tracking.leadlander.com/tracking.png

91 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/ 81 KB
16 KB 380ms
142ms Document
text/html 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx / WP Engine
Resource Hash: ae15245b5be3b599b55fe5cb18f907431d719ebd1f08fa6156236ed29bb9c2da

Request headers

:method: GET
:authority: cofense.com
:scheme: https
:path: /invoice-themed-phishing-emails-are-spreading-from-trusted-links/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Thu, 23 Jul 2020 07:39:04 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
link: <https://cofense.com/?p=21346>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 19
x-cache-group: normal
content-encoding: br

GET
H2 200 autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
cofense.com/wp-content/cache/autoptimize/css/ 2 MB
327 KB 170ms
167ms Stylesheet
text/css 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: aa8cab81eef537e66c9c03335305113b78149e134e77245cac73bfd2e8d6b729

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:04 GMT
content-encoding: br
last-modified: Thu, 23 Jul 2020 07:31:51 GMT
server: nginx
status: 200
etag: W/"5f193ce7-237ccb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.css
use.fontawesome.com/releases/v5.8.2/css/ 54 KB
14 KB 46ms
13ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.2/css/all.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:04 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2019 16:50:11 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"77cbad34e5ce95e70847b074e05faeab"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.13.0/css/ 57 KB
14 KB 46ms
16ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Origin: https://cofense.com

Response headers

date: Thu, 23 Jul 2020 07:39:04 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:20 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"76cb46c10b6c0293433b371bae2414b2"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 css
fonts.googleapis.com/ 10 KB
871 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C300%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5c06b6329970d1560039f39c4935a041d96fcf0f877b47951d8ece559a1b4dc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 07:39:04 GMT
server: ESF
date: Thu, 23 Jul 2020 07:39:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 23 Jul 2020 07:39:04 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
700 B 18ms
16ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat%3A400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00838395cd8b377d7164786319e394a09e9002e048ecb8651c1d7ba94b2d65a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 05:59:12 GMT
server: ESF
date: Thu, 23 Jul 2020 07:39:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 23 Jul 2020 07:39:04 GMT

GET
H2 200 css
fonts.googleapis.com/ 5 KB
645 B 17ms
15ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

01047f6f2af472213a6b11d2517feb5f792ac86eb0ce91772b317a54e00f2a38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 07:37:34 GMT
server: ESF
date: Thu, 23 Jul 2020 07:39:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 23 Jul 2020 07:39:04 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
559 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 05:52:56 GMT
server: ESF
date: Thu, 23 Jul 2020 07:39:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 23 Jul 2020 07:39:04 GMT

GET
H2 200 css
fonts.googleapis.com/ 28 KB
1 KB 24ms
22ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

94df22701bd80fca42c776b7064a4505986161b616007963e1ba60adba6f84d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 07:33:43 GMT
server: ESF
date: Thu, 23 Jul 2020 07:39:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 23 Jul 2020 07:39:04 GMT

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.13.0/css/ 26 KB
5 KB 56ms
27ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/v4-shims.css
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Origin: https://cofense.com

Response headers

date: Thu, 23 Jul 2020 07:39:04 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:22 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"fb073a92592d70e5aa6e3cce1cf93a11"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 jquery.js Show response
cofense.com/wp-includes/js/jquery/ 95 KB
34 KB 169ms
167ms Script
application/javascript 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:04 GMT
content-encoding: br
last-modified: Wed, 22 Jul 2020 21:58:26 GMT
server: nginx
status: 200
etag: W/"5f18b682-17a69"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 shareaholic.js Show response
dsms0mj1bbhn4.cloudfront.net/assets/pub/ 9 KB
4 KB 42ms
8ms Script
application/javascript 2600:9000:214f:2000:c:d51b:4400:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:2000:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2ac1ae71b29646f9752043e40d883852a16aec9ada51ff7198daffcd41fb6c04

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:27:17 GMT
content-encoding: gzip
age: 710
x-cache: Hit from cloudfront
status: 200
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 3699
access-control-allow-origin: *
last-modified: Mon, 20 Jul 2020 15:16:51 GMT
server: nginx
etag: "5cdf1d43cfa9204f5749fd3a38ae82a4"
content-type: application/javascript; charset=UTF-8
via: 1.1 110641d379117242a91443ac729d6def.cloudfront.net (CloudFront)
cache-control: max-age=900, public
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
x-amz-cf-id: Ljv8YgkhEmr2D-PPs3zcHZu5RfYRtK5q26QaWrmNFiGPLQJpQ_eh-g==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 85 KB
34 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3c94631990b6eff72b16a176a33a75c0de8a7c76d8fa4016c2ee0a1ce683e6e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34205
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 23 Jul 2020 07:39:05 GMT

GET
H2 200 cofense-logo.svg
cofense.com/wp-content/themes/copro/images/ 3 KB
1 KB 134ms
133ms Image
image/svg+xml 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/cofense-logo.svg
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
last-modified: Wed, 22 Jul 2020 22:00:00 GMT
server: nginx
status: 200
etag: W/"5f18b6e0-b20"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cofense-cbfree.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 226ms
226ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-cbfree.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-c2a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3114

GET
H2 200 cofense-lms.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 122ms
118ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-lms.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-cd3"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3283

GET
H2 200 cofense-reporter.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 125ms
121ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-reporter.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-b2e"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2862

GET
H2 200 cofense-triage.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 127ms
123ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-triage.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-c04"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3076

GET
H2 200 cofense-vision.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 128ms
125ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-vision.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-ad5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2773

GET
H2 200 cofense-pds.png
cofense.com/wp-content/uploads/2019/01/ 4 KB
4 KB 129ms
125ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-pds.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-ff4"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4084

GET
H2 200 cofense-intelligence.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 133ms
129ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-intelligence.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-c34"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3124

GET
H2 200 cofense-livefeed.png
cofense.com/wp-content/uploads/2019/01/ 5 KB
5 KB 123ms
120ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-livefeed.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-12ad"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4781

GET
H2 200 virus-01.png
cofense.com/wp-content/uploads/2020/03/ 6 KB
7 KB 125ms
122ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/03/virus-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:41 GMT
server: nginx
status: 200
etag: "5f18b691-198b"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6539

GET
H2 200 wfh-01.png
cofense.com/wp-content/uploads/2020/04/ 4 KB
4 KB 126ms
122ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/04/wfh-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:37 GMT
server: nginx
status: 200
etag: "5f18b68d-111d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4381

GET
H2 200 cofense-threat_education.png
cofense.com/wp-content/uploads/2019/01/ 4 KB
4 KB 127ms
124ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-threat_education.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-e51"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3665

GET
H2 200 phishing-threats-db.png
cofense.com/wp-content/uploads/2020/06/ 5 KB
5 KB 133ms
130ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/06/phishing-threats-db.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:31 GMT
server: nginx
status: 200
etag: "5f18b687-1469"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5225

GET
H2 200 cofense-cloud_seeker.png
cofense.com/wp-content/uploads/2019/01/ 4 KB
5 KB 134ms
131ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-cloud_seeker.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-1166"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4454

GET
H2 200 cofense-threat_alerts.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 134ms
132ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-threat_alerts.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2f646c0b23cd81ccb0a37a96186572b394b4e2dfd4974da05559d7381d5989a4

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:05 GMT
server: nginx
status: 200
etag: "5f18b6a9-c7a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3194

GET
H2 200 WM_PP.png.wm-1-1200x792.jpg
cofense.com/wp-content/uploads/2020/07/ 83 KB
84 KB 226ms
223ms Image
image/jpeg 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/07/WM_PP.png.wm-1-1200x792.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e90efba468db3c749572a2263f800bf5af9bf63d19e0ac7af4f3638b412bfd46

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:30 GMT
server: nginx
status: 200
etag: "5f18b686-14d77"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 85367

GET
H2 200 WM_PP-initial-page-.png.wm-1200x603.jpg
cofense.com/wp-content/uploads/2020/07/ 19 KB
20 KB 229ms
227ms Image
image/jpeg 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/07/WM_PP-initial-page-.png.wm-1200x603.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 50ec375e1f779ae153e3736b66fb42550d70e68666b7d363e21671f6d8e7ee31

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:30 GMT
server: nginx
status: 200
etag: "5f18b686-4d1b"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 19739

GET
H2 200 WM_PP-2nd-page-.png.wm-1200x536.jpg
cofense.com/wp-content/uploads/2020/07/ 26 KB
26 KB 230ms
227ms Image
image/jpeg 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/07/WM_PP-2nd-page-.png.wm-1200x536.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 126cfa7252ab352ec4c2abb0efaa2ec2d5dc04f1bc23b753f4bd7b491c62bc15

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:30 GMT
server: nginx
status: 200
etag: "5f18b686-6869"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 26729

GET
H2 200 WM_PP-phish-page-.png.wm-1200x741.jpg
cofense.com/wp-content/uploads/2020/07/ 30 KB
30 KB 230ms
227ms Image
image/jpeg 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/07/WM_PP-phish-page-.png.wm-1200x741.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 47eff0d021fee090480453ccc23530bfca372f4fd10d698f469862894e9b1d36

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:30 GMT
server: nginx
status: 200
etag: "5f18b686-7700"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 30464

GET
H2 200 WM_Office-page-.png.wm-1200x499.jpg
cofense.com/wp-content/uploads/2020/07/ 69 KB
70 KB 230ms
228ms Image
image/jpeg 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/07/WM_Office-page-.png.wm-1200x499.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 031d271895860e32d08f79ee954122c060e473a44cb0047dcc7d00d5ed4fdf4b

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:58:29 GMT
server: nginx
status: 200
etag: "5f18b685-1155f"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 71007

GET
H2 200 autoptimize_cf97f264d9bc936b3c79cb49023e3af3.js Show response
cofense.com/wp-content/cache/autoptimize/js/ 635 KB
177 KB 230ms
228ms Script
application/javascript 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/cache/autoptimize/js/autoptimize_cf97f264d9bc936b3c79cb49023e3af3.js
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: af01b8f07077ea6906159ae96aaa7cbc5c550bff3849b080f49b5b984dba491d

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
last-modified: Wed, 22 Jul 2020 22:00:56 GMT
server: nginx
status: 200
etag: W/"5f18b718-9ecee"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 6 KB
774 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:300,400,700

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a0b058fefacf4a80e3c8f4c4914fa64c81a2820b9d7a82990e9d7cc7914fd4f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 07:17:49 GMT
server: ESF
date: Thu, 23 Jul 2020 07:39:05 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 23 Jul 2020 07:39:05 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 150 KB
51 KB 27ms
25ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e6242c882e6cd09d292f62755ed42867d4c1e7105ba8c8f50a994327a3bee46d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52048
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 23 Jul 2020 07:39:05 GMT

GET
H2 200 wp-emoji-release.min.js Show response
cofense.com/wp-includes/js/ 14 KB
5 KB 230ms
228ms Script
application/javascript 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/wp-emoji-release.min.js?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
last-modified: Wed, 22 Jul 2020 21:58:26 GMT
server: nginx
status: 200
etag: W/"5f18b682-364d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 28krvx2uf9n3.js Show response
js.driftt.com/include/1595490000000/ 137 KB
45 KB 217ms
149ms Script
application/javascript 143.204.202.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1595490000000/28krvx2uf9n3.js

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

143.204.202.100 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-100.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

aa371b695a477025f6fd48693baea5a6ed0ff4eb71c5a660d854e543b2370013

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Tue, 21 Jul 2020 15:30:20 GMT
server: nginx
date: Thu, 23 Jul 2020 07:39:05 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=UTF-8
via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront)
cache-control: max-age=10
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QbuG6ns99cokYEHN2_zn0cB-gHNbmjqyDwGyonT-Nn-bQUxUJbJffw==

GET
H2 200 nav-arrow.png
cofense.com/wp-content/themes/copro/images/ 3 KB
3 KB 220ms
219ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/nav-arrow.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9

Request headers

Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 22:00:00 GMT
server: nginx
status: 200
etag: "5f18b6e0-b8d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2957

GET
H2 200 icn-nav-search@2x.png
cofense.com/wp-content/themes/copro/images/ 1 KB
1 KB 220ms
219ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/icn-nav-search@2x.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f

Request headers

Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 22:00:00 GMT
server: nginx
status: 200
etag: "5f18b6e0-514"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1300

GET
H2 200 b-g.png
cofense.com/wp-content/themes/copro/images/ 840 KB
841 KB 124ms
123ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/b-g.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9

Request headers

Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 22:00:07 GMT
server: nginx
status: 200
etag: "5f18b6e7-d20af"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 860335

GET
H2 200 footer-graphic.png
cofense.com/wp-content/uploads/2016/07/ 16 KB
16 KB 214ms
213ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1c80b6cd2eba57ae2b468a90b970f45790801cfd609a37bce090b8b65dc0a55f

Request headers

Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:44 GMT
server: nginx
status: 200
etag: "5f18b6d0-4105"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 16645

GET
H2 200 footer-graphic-b.png
cofense.com/wp-content/uploads/2016/07/ 212 B
413 B 214ms
214ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic-b.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a

Request headers

Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:44 GMT
server: nginx
status: 200
etag: "5f18b6d0-d4"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 212

GET
H2 200 footer-graphic-a.png
cofense.com/wp-content/uploads/2016/07/ 107 B
308 B 215ms
214ms Image
image/png 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic-a.png
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb

Request headers

Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Wed, 22 Jul 2020 21:59:44 GMT
server: nginx
status: 200
etag: "5f18b6d0-6b"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 107

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 78 KB
78 KB 15ms
15ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-solid-900.woff2
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
Origin: https://cofense.com

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Mon, 23 Mar 2020 16:08:17 GMT
server: NetDNA-cache/2.2
status: 200
etag: "b15db15f746f29ffa02638cb455b8ec0"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 79444

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
Origin: https://cofense.com

Response headers

date: Thu, 09 Jul 2020 02:32:55 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 1227970
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Fri, 09 Jul 2021 02:32:55 GMT

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 75 KB
75 KB 31ms
30ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-brands-400.woff2
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/wp-content/cache/autoptimize/css/autoptimize_6a6b640ba34cdcfaf7457d7c3dbb8551.css
Origin: https://cofense.com

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Mon, 23 Mar 2020 16:10:04 GMT
server: NetDNA-cache/2.2
status: 200
etag: "a06da7f0950f9dd366fc9db9d56d618a"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 76612

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v17/ 40 KB
40 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v17/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

293c1f5f923e599f3adadeb96b2367c11f890343508c57b2c905d1c91d2a07ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1
Origin: https://cofense.com

Response headers

date: Wed, 15 Jul 2020 21:15:17 GMT
x-content-type-options: nosniff
last-modified: Wed, 15 Jul 2020 20:51:40 GMT
server: sffe
age: 642228
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40692
x-xss-protection: 0
expires: Thu, 15 Jul 2021 21:15:17 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
Origin: https://cofense.com

Response headers

date: Fri, 12 Jun 2020 20:41:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 3495449
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Sat, 12 Jun 2021 20:41:36 GMT

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 12 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
Origin: https://cofense.com

Response headers

date: Wed, 08 Jul 2020 21:51:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 1244842
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12680
x-xss-protection: 0
expires: Thu, 08 Jul 2021 21:51:43 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
Origin: https://cofense.com

Response headers

date: Wed, 10 Jun 2020 14:25:07 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 3690838
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11020
x-xss-protection: 0
expires: Thu, 10 Jun 2021 14:25:07 GMT

GET
H2 200 main.js Show response
m9m6e2w5.stackpathcdn.com/v2/afd0a0fc/ 139 KB
40 KB 50ms
16ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://m9m6e2w5.stackpathcdn.com/v2/afd0a0fc/main.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: addc9c2bdd5ac655e8624862e3b5ccbe63bb437fa77fb1ccabbf7637c357a5b3

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: gzip
last-modified: Mon, 20 Jul 2020 15:16:48 GMT
server: nginx
x-amz-request-id: B8570ADF2AA28E8F
etag: "cc910ee040ef3ebaecf13ec28262a3f2"
x-hw: 1595489945.cds067.am5.hn,1595489945.cds007.am5.c
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 40842
x-amz-id-2: sQIts4zEmoOsM3dCEwpbS6tA4PFE3JoBvZkzmAmnoFrQsKWoveQN/Aab/Samnotz/JCSPEdC7sw=

GET
H2 200 62df9f201cc7c19a56912daae814efca.json Show response
www.shareaholic.net/config/ 11 KB
2 KB 349ms
110ms XHR
application/json 54.197.98.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.197.98.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-197-98-98.compute-1.amazonaws.com
Software: nginx /
Resource Hash: c772e9910a0083fd8b058830a4dcd7c2c9307da32cee9700af1fa089ac141a8b

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-client-geo-country: NL,Netherlands
date: Wed, 22 Jul 2020 17:50:58 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-origin: *
status: 200
access-control-allow-methods: GET, HEAD
content-length: 1658
server: nginx
x-client-geo-region: UT,Provincie Utrecht
x-client-geo-metrocode
etag: W/"c772e9910a0083fd8b058830a4dcd7c2"
access-control-max-age: 2000
x-client-geo-city: Utrecht
x-varnish: 303669889 284198102
via: 1.1 varnish (Varnish/6.0)
access-control-expose-headers: Etag, Access-Control-Allow-Origin, x-client-geo-latlong, x-client-geo-country, x-client-geo-city, x-client-geo-zip, x-client-geo-region, x-client-geo-metrocode
cache-control: max-age=3, public, must-revalidate
x-client-geo-zip: 3526
accept-ranges: bytes
content-type: application/json
access-control-allow-headers: *
x-client-geo-latlong: 52.069000,5.102400

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
11 KB 34ms
28ms Script
text/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71aa66e3c94df617c70a1b9530acaa18c9f049d6d29dbaa6d0efe84d7104805a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11323
x-xss-protection: 0
server: cafe
etag: 17153042000983114910
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 23 Jul 2020 07:39:05 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 3923
date: Thu, 23 Jul 2020 06:33:42 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Thu, 23 Jul 2020 08:33:42 GMT

GET
H2 200 hotjar-1312741.js Show response
static.hotjar.com/c/ 13 KB
3 KB 43ms
13ms Script
application/javascript 147.75.102.197
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.102.197 Central, Hong Kong, ASN54825 (PACKET, US),

Reverse DNS

Software

Resource Hash

fb14ba88cc310ffca30ad6ffa5a1285a7d21fe5efdb0a055cf083487d415f4a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjarjs
age: 334
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 3058
cache-control: max-age=60
etag: W/4a9a296206fcb9998798e9545937a04c
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.072
accept-ranges: bytes
section-io-id: 1c0408560450e0f4e5183f61f92e2109
section-origin-responded: true

GET
H2 200 bat.js Show response
bat.bing.com/ 26 KB
8 KB 40ms
28ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref: Ref A: 1D42531797E1477A9EC6607CB205A518 Ref B: FRAEDGE1314 Ref C: 2020-07-23T07:39:05Z
status: 200
etag: "0e0bdafab5bd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8022

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:eb:3b3::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:eb:3b3::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 07:39:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=22750
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 134 KB
34 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34220
x-xss-protection: 0
pragma: public
x-fb-debug: GzYchmEpDhtfnoSbJsm05ACrIgkJjubeHymu6g9TlnYCugZ9Dd4t4986xntw+edvE0SwfEAZh5AaiBKeeiI6Eg==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 23 Jul 2020 07:39:05 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sf14g.js Show response
t.sf14g.com/ 37 KB
37 KB 357ms
109ms Script
application/javascript 34.230.159.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sf14g.com/sf14g.js

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.230.159.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Kestrel /

Resource Hash

86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Tue, 16 Oct 2018 18:33:02 GMT
server: Kestrel
etag: "1d4657eab9c909b"
strict-transport-security: max-age=2592000
content-type: application/javascript
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 37787
expires: -1

GET
H2 200 api.min.js Show response
a.optnmstr.com/app/js/ 199 KB
59 KB 76ms
12ms Script
application/javascript 23.111.11.83
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.optnmstr.com/app/js/api.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.83 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c8734157d24d0a9f5789662607770832b3c5764b695c0c859c9fa4ac9d7dfa80

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: gzip
last-modified: Fri, 17 Jul 2020 05:01:51 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 5696116560A9B275
etag: W/"7306e30d8e6d8ab8dd4d3fceb5b71471"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: XMI5P60ucAdgEex/2/HCnZjWmCLQAbqr5stqG0ivuq/9lBXSdADWXI1i9IAmumk0NMYDKGHFWSA=
expires: Sun, 18 Jul 2021 07:39:05 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 59ms
18ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: gzip
age: 36428
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4031-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1595489946.634307,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 2Uq3HoQoVZEHgHXXf288 Show response
ws.zoominfo.com/pixel/ 0
723 B 275ms
241ms Script
text/javascript 104.16.168.82
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.168.82 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Express
status: 200
content-length: 0
cf-request-id: 041c35a0190000d921bcba6200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 5b73bee02fdcd921-AMS
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for

POST
H2 200 e
analytics.shareaholic.com/ 43 B
376 B 289ms
94ms Other
image/gif 52.22.109.130
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.shareaholic.com/e

Requested by

Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/afd0a0fc/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.109.130 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Content-Security-Policy	referrer always

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:05 GMT
status: 200
vary: Origin
p3p: CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC"
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
referer-policy: unsafe-url
content-security-policy: referrer always
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/ 2 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1595489945675&cv=9&fst=1595489945675&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa7f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&tiba=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links%20-%20Cofense&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6de9b9b7e6b76678e1cc2672b1a0a22814466f01b6fe231a1b0e7c5d6856ccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1094
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 admin-ajax.php Show response
cofense.com/wp-admin/ 3 KB
1 KB 1578ms
1577ms XHR
application/json 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cofense.com/wp-admin/admin-ajax.php?action=buttonizer&qpu=4d8362c0a91845d9c18c1b4fdea9a7f8&preview=0&data%5Bpage%5D=21346&data%5Bcategories%5D%5B%5D=14&data%5Bcategories%5D%5B%5D=13459&data%5Bcategories%5D%5B%5D=12&data%5Bcategories%5D%5B%5D=13112&data%5Bcategories%5D%5B%5D=9084&data%5Bblog%5D=1&data%5Bis_404%5D=false&data%5Bis_front_page%5D=false&data%5Btitle%5D=Invoice+Themed+Phishing+Emails+Are+Spreading+from+Trusted+Links&data%5Burl%5D=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F

Requested by

Host: cofense.com
URL: https://cofense.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.188.168.180 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

180.168.188.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

bea1381b0f6d199d0f62d78115766b6ebd62079f46a095a06dfd6383610e6c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: NO:Passed
x-pass-why: wp-admin
x-powered-by: WP Engine
x-cache: MISS
status: 200
pragma: cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Accept-Encoding
content-type: application/json; charset=UTF-8
cache-control: max-age=0, must-revalidate, private
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&time=1595489945780
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26url%3Dhttps%253A%252F%252Fcofense.com%252Finvoice-themed-phishing-emails...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&time=1595489945780&liSync=true

0
63 B

104ms
103ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&time=1595489945780&liSync=true
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:06 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: e4TAE6dRJBaAhhvz6CoAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: oFDTDqdRJBaAAn/EzSoAAA==
pragma: no-cache
x-li-pop: afd-prod-lva1
x-msedge-ref: Ref A: 400911A8A9514E0CB9DAE1A85931F0B6 Ref B: FRAEDGE0807 Ref C: 2020-07-23T07:39:05Z
x-frame-options: sameorigin
date: Thu, 23 Jul 2020 07:39:05 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&time=1595489945780&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 70 KB
28 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-K29SPQM&t=gtm5&cid=1836128849.1595489946&aip=true

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e86d2bdb7d85ed549fa7e1831116a37bd797a7ca6688237cdf0a6b480e9e562a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28088
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 23 Jul 2020 07:39:05 GMT

GET
H2 200 2469609446468850 Show response
connect.facebook.net/signals/config/ 522 KB
132 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2469609446468850?v=2.9.22&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

702cb41f6d0781e816a1fd95b638901d99eb769ee173538662867271ba4ba4fa

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 134577
x-xss-protection: 0
pragma: public
x-fb-debug: P0rweHr+67xXSIUJUoqzjClbqKiz1PNCju7RPKoo9E74YgdMvD29W61jzysNkdVyjGuN998WH9nS2Ii9yMulwQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 23 Jul 2020 07:39:05 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
149 B 28ms
27ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=26041328&Ver=2&mid=49a1ad6e-f4b6-7667-a6af-8c5b5e74a24f&sid=58f0be8bc0f506161b85e997072e2fc5&vid=fe0d2568be14fe0d745992c5082d0878&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links%20-%20Cofense&p=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&r=&lt=1544&evt=pageLoad&msclkid=N&sv=1&rn=246663
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Thu, 23 Jul 2020 07:39:05 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: A905D9867E5E45BBBE761CBE63799830 Ref B: FRAEDGE1314 Ref C: 2020-07-23T07:39:05Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.34bb0d0fa29ee682970a.js Show response
script.hotjar.com/ 424 KB
87 KB 45ms
16ms Script
application/javascript 147.75.102.197
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.34bb0d0fa29ee682970a.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.102.197 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS
Software: /
Resource Hash: cf34b191fe0038f88e0579ed495e14cff324d843ba325b18754523e2ad613e60

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
content-encoding: br
age: 65866
status: 200
section-io-cache: Hit
content-length: 88767
last-modified: Wed, 22 Jul 2020 13:17:49 GMT
etag: "ddd2cb07f9a907f78e3f86fe56e6f509"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.026
section-io-id: 438158f9bc8eaba9e85faa89926d8eb2
accept-ranges: bytes
content-type: application/javascript
section-origin-responded: true

GET
H2 200 818 Show response
api.omappapi.com/v2/embed/ 134 KB
17 KB 269ms
219ms XHR
application/json 13.35.254.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/818
Requested by: Host: a.optnmstr.com
URL: https://a.optnmstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.254.73 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Pagely Gateway/1.5.1 /
Resource Hash: 50d1e56e2a1672bcaf8528de34a292d54770b9fcc890770b59e0934817b5dfae

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:06 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: FRA6-C1
x-cache-status: HIT
x-cache: Miss from cloudfront
status: 200
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 834
x-user-agent: standard--
last-modified: Tue, 05 May 2020 19:08:45 GMT
server: Pagely Gateway/1.5.1
etag: W/"df455d424fdc1624598c08cff1c9cca0"
vary: Accept-Encoding, User-Agent
content-type: application/json
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account
cache-control: public, max-age=30, stale-while-revalidate=1800
access-control-allow-origin: *
x-amz-cf-id: TFHbLYWbFdDPRIxmHiUA5wjywqtw5XAHDe9zrmgePLnxma-T5v4cIA==
expires: Thu, 23 Jul 2020 07:38:46 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 182ms
138ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Thu, 23 Jul 2020 07:39:06 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 21edcf2b4947fdce8dd77c178a608595
x-transaction: 00c6727500cf0d13
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1061448384/ 42 B
119 B 19ms
19ms Image
image/gif 2a00:1450:4001:817::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061448384/?random=1595489945675&cv=9&fst=1595487600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa7f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&tiba=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=898671680&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1061448384/ 42 B
107 B 22ms
21ms Image
image/gif 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1061448384/?random=1595489945675&cv=9&fst=1595487600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa7f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&tiba=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=898671680&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame E8A8 0
0 47ms
13ms Document
text/html 147.75.33.233
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.33.233 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Response headers

status: 200
date: Thu, 23 Jul 2020 07:39:05 GMT
content-type: text/html
content-length: 851
last-modified: Thu, 23 Jul 2020 06:51:04 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.138
section-origin-responded: true
age: 1497
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: 3e97b4c81cd7d708b6dda2c3d86e2374

GET
H2 200 /
www.facebook.com/tr/ 44 B
260 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2469609446468850&ev=PageView&dl=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&rl=&if=false&ts=1595489945925&sw=1600&sh=1200&v=2.9.22&r=stable&ec=0&o=30&fbp=fb.1.1595489945924.367463687&it=1595489945803&coo=false&rqm=GET

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 23 Jul 2020 07:39:05 GMT

GET
H2 200 partners.js Show response
partner.shareaholic.com/ 0
265 B 337ms
122ms Script
application/javascript 107.20.140.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&cl=en-US&id_sync=7e822450-cac7-4f68-adee-3e1161941236&minify=1&pvs=1&site=62df9f201cc7c19a56912daae814efca
Requested by: Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/afd0a0fc/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.140.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:06 GMT
vary: Accept-Encoding, User-Agent
p3p: CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC'
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=utf-8
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
98 B 6ms
6ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&aip=1&a=225379866&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&ul=en-us&de=UTF-8&dt=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgUADQ~&jid=752292776&gjid=1312595949&cid=1836128849.1595489946&tid=UA-114787942-1&_gid=1826815700.1595489946&gtm=2wg7f05RQ37KH&z=2073045704

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Jun 2020 13:58:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3519633
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&gjid=1312595949&_gid=1826815700.1595489946&_u=aGDAgUADQ~&z=1062360251
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&_v=j83&z=1062360251
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&_v=j83&z=1062360251&slf_rd=1&random=1690961931

42 B
106 B

18ms
18ms

Image
image/gif

2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&_v=j83&z=1062360251&slf_rd=1&random=1690961931

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:06 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=1836128849.1595489946&jid=752292776&_v=j83&z=1062360251&slf_rd=1&random=1690961931
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1312741/ 178 B
320 B 108ms
40ms XHR
application/json 54.194.207.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1312741/visit-data?sv=7
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.34bb0d0fa29ee682970a.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.207.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 23 Jul 2020 07:39:06 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.18/ 16 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Requested by

Host: a.optnmstr.com
URL: https://a.optnmstr.com/app/js/api.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 22 Jul 2020 20:54:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38665
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6490
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Jul 2021 20:54:41 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
103 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarynEgxDY0MmP0u5LdU

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Thu, 23 Jul 2020 07:39:06 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://cofense.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H2

200

tracking.png
tracking.leadlander.com/
Redirect Chain

https://tracking.leadlander.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&referer=&fp=f10d44237416b9907b2c88ae...
https://tracking.leadlander.com/tracking.png

68 B
296 B

99ms
98ms

Image
image/png

3.85.187.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tracking.leadlander.com/tracking.png

Requested by

Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.85.187.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Kestrel /

Resource Hash

69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Jul 2020 07:39:06 GMT
last-modified: Wed, 26 Sep 2018 16:48:51 GMT
server: Kestrel
etag: "1d455b8cd761bc4"
strict-transport-security: max-age=2592000
content-type: image/png
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 68
expires: -1

Redirect headers

status: 302
date: Thu, 23 Jul 2020 07:39:06 GMT
server: Kestrel
access-control-allow-origin: *
location: /tracking.png
content-length: 0
strict-transport-security: max-age=2592000

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 394ms
99ms Script
application/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: cofense.com
URL: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 07:39:07 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Last-Modified: Fri, 13 Mar 2020 19:48:42 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Sat, 23 Jul 2022 07:39:07 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
650 B 185ms
142ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 07:39:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 122
pragma: no-cache
last-modified: Thu, 23 Jul 2020 07:39:07 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c4d1060cebe2dbc50024eac07616ddc5
x-transaction: 001bf64300108a5c
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 index.html
js.driftt.com/deploy/assets/ Frame BF7D 0
0 25ms
24ms Document
text/html 143.204.202.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/index.html

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1595490000000/28krvx2uf9n3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

143.204.202.100 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-100.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /deploy/assets/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 894
server: nginx
last-modified: Tue, 21 Jul 2020 15:30:19 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 23 Jul 2020 07:38:59 GMT
etag: "be339798e2388c69e8bceea6b7f5552d"
cache-control: max-age=10
x-cache: Hit from cloudfront
via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: DzM8XXgE0SYuhX96Z8DngwThgf-Xmw_apVrqdqtqIpLvQ1alJwv9TA==
age: 7

GET
H2 200 css
fonts.googleapis.com/ 4 KB
774 B 20ms
16ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:600,400%7CUbuntu:600,400

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6410f17e92d2a1050387d0c05e3ba8cdb4e9a8e713011a805b1817ab6c11d77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 23 Jul 2020 07:39:06 GMT
server: ESF
date: Thu, 23 Jul 2020 07:39:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 23 Jul 2020 07:39:06 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto:600,400%7CUbuntu:600,400
Origin: https://cofense.com

Response headers

date: Fri, 12 Jun 2020 20:41:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 3495451
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Sat, 12 Jun 2021 20:41:36 GMT

GET
H2 200 4iCs6KVjbNBYlgoKfw72nU6AFw.woff2
fonts.gstatic.com/s/ubuntu/v14/ 13 KB
14 KB 6ms
4ms Font
font/woff2 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v14/4iCs6KVjbNBYlgoKfw72nU6AFw.woff2

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto:600,400%7CUbuntu:600,400
Origin: https://cofense.com

Response headers

date: Fri, 12 Jun 2020 00:30:05 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:17:45 GMT
server: sffe
age: 3568142
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13720
x-xss-protection: 0
expires: Sat, 12 Jun 2021 00:30:05 GMT

GET
H/1.0 200
OK analytics Show response
pi.pardot.com/ 1 KB
1 KB 149ms
148ms Script
text/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1564&account_id=47382&title=Invoice%20Themed%20Phishing%20Emails%20Are%20Spreading%20from%20Trusted%20Links%20-%20Cofense&url=https%3A%2F%2Fcofense.com%2Finvoice-themed-phishing-emails-are-spreading-from-trusted-links%2F&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: PardotServer /
Resource Hash: ba2ea83824fa4727e553d845e6a35e7d5337d51ab12b3fc371260f6195003432

Request headers

Referer: https://cofense.com/invoice-themed-phishing-emails-are-spreading-from-trusted-links/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 23 Jul 2020 07:39:07 GMT
Content-Encoding: gzip
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
X-Pardot-Rsp: 16/93/247
Vary: Accept-Encoding,User-Agent
P3p: CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 672
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

265 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.cofense.com/	1970-01-19 13:21:05	Name: _fbp Value: fb.1.1595489946492.387996713

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cofense.com/wp-content/cache/autoptimize/js/autoptimize_cf97f264d9bc936b3c79cb49023e3af3.js(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optnmstr.com
ajax.googleapis.com
analytics.shareaholic.com
analytics.twitter.com
api.omappapi.com
bat.bing.com
cofense.com
connect.facebook.net
dsms0mj1bbhn4.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
in.hotjar.com
js.driftt.com
m9m6e2w5.stackpathcdn.com
partner.shareaholic.com
pi.pardot.com
px.ads.linkedin.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
t.sf14g.com
tracking.leadlander.com
use.fontawesome.com
vars.hotjar.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.shareaholic.net
104.16.168.82
104.244.42.195
104.244.42.69
107.20.140.231
13.35.254.73
143.204.202.100
147.75.102.197
147.75.33.233
151.101.112.157
151.139.128.11
216.58.212.130
23.111.11.83
23.111.9.35
2600:9000:214f:2000:c:d51b:4400:21
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:808::2008
2a00:1450:4001:808::200e
2a00:1450:4001:80b::2003
2a00:1450:4001:816::200a
2a00:1450:4001:817::2004
2a00:1450:4001:818::2003
2a00:1450:4001:81e::200a
2a00:1450:4001:821::2002
2a00:1450:400c:c00::9d
2a02:26f0:eb:3b3::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.85.187.26
34.230.159.139
35.174.151.106
35.188.168.180
52.22.109.130
54.194.207.225
54.197.98.98
00838395cd8b377d7164786319e394a09e9002e048ecb8651c1d7ba94b2d65a0
01047f6f2af472213a6b11d2517feb5f792ac86eb0ce91772b317a54e00f2a38
031d271895860e32d08f79ee954122c060e473a44cb0047dcc7d00d5ed4fdf4b
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f
0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
126cfa7252ab352ec4c2abb0efaa2ec2d5dc04f1bc23b753f4bd7b491c62bc15
12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149
1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3
1c80b6cd2eba57ae2b468a90b970f45790801cfd609a37bce090b8b65dc0a55f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0
21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f
293c1f5f923e599f3adadeb96b2367c11f890343508c57b2c905d1c91d2a07ea
2ac1ae71b29646f9752043e40d883852a16aec9ada51ff7198daffcd41fb6c04
2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c
2f646c0b23cd81ccb0a37a96186572b394b4e2dfd4974da05559d7381d5989a4
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
3c94631990b6eff72b16a176a33a75c0de8a7c76d8fa4016c2ee0a1ce683e6e5
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
47eff0d021fee090480453ccc23530bfca372f4fd10d698f469862894e9b1d36
50d1e56e2a1672bcaf8528de34a292d54770b9fcc890770b59e0934817b5dfae
50ec375e1f779ae153e3736b66fb42550d70e68666b7d363e21671f6d8e7ee31
5c06b6329970d1560039f39c4935a041d96fcf0f877b47951d8ece559a1b4dc6
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
702cb41f6d0781e816a1fd95b638901d99eb769ee173538662867271ba4ba4fa
71aa66e3c94df617c70a1b9530acaa18c9f049d6d29dbaa6d0efe84d7104805a
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a
8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010
94df22701bd80fca42c776b7064a4505986161b616007963e1ba60adba6f84d5
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0b058fefacf4a80e3c8f4c4914fa64c81a2820b9d7a82990e9d7cc7914fd4f5
a6410f17e92d2a1050387d0c05e3ba8cdb4e9a8e713011a805b1817ab6c11d77
aa371b695a477025f6fd48693baea5a6ed0ff4eb71c5a660d854e543b2370013
aa8cab81eef537e66c9c03335305113b78149e134e77245cac73bfd2e8d6b729
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
addc9c2bdd5ac655e8624862e3b5ccbe63bb437fa77fb1ccabbf7637c357a5b3
ae15245b5be3b599b55fe5cb18f907431d719ebd1f08fa6156236ed29bb9c2da
af01b8f07077ea6906159ae96aaa7cbc5c550bff3849b080f49b5b984dba491d
ba2ea83824fa4727e553d845e6a35e7d5337d51ab12b3fc371260f6195003432
bea1381b0f6d199d0f62d78115766b6ebd62079f46a095a06dfd6383610e6c78
c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45
c6de9b9b7e6b76678e1cc2672b1a0a22814466f01b6fe231a1b0e7c5d6856ccf
c772e9910a0083fd8b058830a4dcd7c2c9307da32cee9700af1fa089ac141a8b
c8734157d24d0a9f5789662607770832b3c5764b695c0c859c9fa4ac9d7dfa80
ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
cf34b191fe0038f88e0579ed495e14cff324d843ba325b18754523e2ad613e60
d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4
dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6242c882e6cd09d292f62755ed42867d4c1e7105ba8c8f50a994327a3bee46d
e86d2bdb7d85ed549fa7e1831116a37bd797a7ca6688237cdf0a6b480e9e562a
e90efba468db3c749572a2263f800bf5af9bf63d19e0ac7af4f3638b412bfd46
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7
f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f
f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c
f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6
fb14ba88cc310ffca30ad6ffa5a1285a7d21fe5efdb0a055cf083487d415f4a9
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69
fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45

cofense.com Open in urlscan Pro 35.188.168.180 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

91 Requests

100 %HTTPS

44 %IPv6

30 Domains

37 Subdomains

34 IPs

7 Countries

2642 kBTransfer

6897 kBSize

1 Cookies

15 Outgoing links

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

100 %
HTTPS

44 %
IPv6

30
Domains

37
Subdomains

34
IPs

7
Countries

2642 kB
Transfer

6897 kB
Size

1
Cookies

91 HTTP transactions
0 data transactions