www.zscaler.com Open in urlscan Pro
2606:4700:4400::ac40:99eb Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Submission: On December 14 via api (December 14th 2024, 11:14:22 am UTC) from IN — Scanned from DE

Summary HTTP 144 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 30 IPs in 5 countries across 21 domains to perform 144 HTTP transactions. The main IP is 2606:4700:4400::ac40:99eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com. The Cisco Umbrella rank of the primary domain is 68501.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 28th 2024. Valid for: a year.

This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
56	2606:4700:440... 2606:4700:4400::ac40:99eb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
1	104.82.89.248 104.82.89.248	16625 (AKAMAI-AS) (AKAMAI-AS)
12	2.19.80.120 2.19.80.120	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2600:9000:223... 2600:9000:223e:7600:c:d449:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2600:1f18:e8a... 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4	14618 (AMAZON-AES) (AMAZON-AES)
2	157.240.253.1 157.240.253.1	32934 (FACEBOOK) (FACEBOOK)
4	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
2 2	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
2 3	172.217.18.4 172.217.18.4	15169 (GOOGLE) (GOOGLE)
3	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
1	142.250.185.232 142.250.185.232	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
2	157.240.0.35 157.240.0.35	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	185.89.210.122 185.89.210.122	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:710... 2a02:26f0:7100::210:172	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
2	13.35.58.28 13.35.58.28	16509 (AMAZON-02) (AMAZON-02)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.194.132 151.101.194.132	54113 (FASTLY) (FASTLY)
1	52.214.206.65 52.214.206.65	16509 (AMAZON-02) (AMAZON-02)
2	52.212.252.64 52.212.252.64	16509 (AMAZON-02) (AMAZON-02)
3	52.89.65.74 52.89.65.74	16509 (AMAZON-02) (AMAZON-02)
5	104.16.117.43 104.16.117.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
144	30

56 2606:4700:4400::ac40:99eb (United States)

ASN13335 (CLOUDFLARENET, US)

www.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.82.89.248 (Hamburg, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-82-89-248.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2.19.80.120 (Hamburg, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-19-80-120.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223e:7600:c:d449:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

ob.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

obs.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.2 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.162 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.4 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.0.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.122 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100::210:172 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.58.28 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-28.fra60.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.214.206.65 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-206-65.eu-west-1.compute.amazonaws.com

117186981.intellimizeio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.212.252.64 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-252-64.eu-west-1.compute.amazonaws.com

api.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.89.65.74 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-89-65-74.us-west-2.compute.amazonaws.com

log.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.16.117.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
63	zscaler.com www.zscaler.com — Cisco Umbrella Rank: 68501 info.zscaler.com — Cisco Umbrella Rank: 680312 cms.zscaler.com	1 MB
17	6sc.co j.6sc.co — Cisco Umbrella Rank: 5557 c.6sc.co — Cisco Umbrella Rank: 6739 ipv6.6sc.co — Cisco Umbrella Rank: 5633 b.6sc.co — Cisco Umbrella Rank: 3603 eps.6sc.co — Cisco Umbrella Rank: 9024 v.eps.6sc.co — Cisco Umbrella Rank: 16220	27 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 329	200 KB
7	iseaskies.com ob.iseaskies.com — Cisco Umbrella Rank: 581120 obs.iseaskies.com — Cisco Umbrella Rank: 410514	40 KB
6	intellimize.co cdn.intellimize.co — Cisco Umbrella Rank: 46431 api.intellimize.co — Cisco Umbrella Rank: 39078 log.intellimize.co — Cisco Umbrella Rank: 37598	111 KB
5	zoominfo.com ws-assets.zoominfo.com — Cisco Umbrella Rank: 11137 ws.zoominfo.com — Cisco Umbrella Rank: 4514	17 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	586 KB
4	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 3 region1.analytics.google.com — Cisco Umbrella Rank: 4108	48 B
4	bing.com bat.bing.com — Cisco Umbrella Rank: 359	16 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5643	4 KB
3	google.de www.google.de — Cisco Umbrella Rank: 10745	191 B
3	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 stats.g.doubleclick.net — Cisco Umbrella Rank: 135	603 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	214 B
2	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 96	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	77 KB
1	intellimizeio.com 117186981.intellimizeio.com
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 495	700 B
1	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3671	1 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 514	295 B
0	acsbapp.com Failed acsbapp.com Failed
144	21

	Domain	Requested by
54	www.zscaler.com	www.zscaler.com
12	cdn.cookielaw.org	www.zscaler.com cdn.cookielaw.org
9	b.6sc.co	www.zscaler.com
7	info.zscaler.com	www.zscaler.com info.zscaler.com
6	obs.iseaskies.com	ob.iseaskies.com www.zscaler.com
5	www.googletagmanager.com	www.zscaler.com ob.iseaskies.com www.googletagmanager.com
4	ws.zoominfo.com	js.zi-scripts.com ws-assets.zoominfo.com
4	bat.bing.com	ob.iseaskies.com bat.bing.com www.zscaler.com
3	log.intellimize.co	cdn.intellimize.co
3	js.zi-scripts.com	www.zscaler.com js.zi-scripts.com
3	www.google.de	www.zscaler.com
3	www.google.com	2 redirects www.googletagmanager.com
2	api.intellimize.co	cdn.intellimize.co
2	v.eps.6sc.co	j.6sc.co
2	eps.6sc.co	j.6sc.co
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.facebook.com	www.zscaler.com
2	googleads.g.doubleclick.net	2 redirects
2	www.googleadservices.com	1 redirects www.googletagmanager.com
2	connect.facebook.net	ob.iseaskies.com connect.facebook.net
2	j.6sc.co	www.zscaler.com j.6sc.co
2	cms.zscaler.com	www.zscaler.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	117186981.intellimizeio.com	cdn.intellimize.co
1	cdn.intellimize.co	www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	ob.iseaskies.com	www.zscaler.com
1	munchkin.marketo.net	www.zscaler.com
1	geolocation.onetrust.com	cdn.cookielaw.org
0	acsbapp.com Failed	www.zscaler.com
144	34

This site contains links to these domains. Also see Links.

Domain
threatlabz.zscaler.com
help.zscaler.com
admin.zscaler.net
admin.zscalerone.net
admin.zscalertwo.net
admin.zscalerthree.net
admin.zscalerbeta.net
admin.zscloud.net
admin.private.zscaler.com
admin.zpatwo.net
partners.zscaler.com
securitypreview.zscaler.com
customer.zscaler.com
community.zscaler.com
ir.zscaler.com
www.facebook.com
x.com
www.linkedin.com
medium.com
www.cisa.gov
www.rapid7.com
threatlibrary.zscaler.com
www.youtube.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
www.zscaler.com DigiCert SHA2 Extended Validation Server CA	`2024-02-28` - `2025-02-23`	a year	crt.sh
cookielaw.org WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
info.zscaler.com WE1	`2024-11-05` - `2025-02-03`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
*.google-analytics.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-22` - `2025-10-24`	a year	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.iseaskies.com Amazon RSA 2048 M02	`2024-06-18` - `2025-07-18`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-09-23` - `2024-12-22`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.googleadservices.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.google.de WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M02	`2024-08-29` - `2025-09-27`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
zi-scripts.com WE1	`2024-11-20` - `2025-02-18`	3 months	crt.sh
cdn.intellimize.co R10	`2024-11-10` - `2025-02-08`	3 months	crt.sh
*.intellimizeio.com Amazon RSA 2048 M02	`2024-09-24` - `2025-10-23`	a year	crt.sh
api.intellimize.co Amazon RSA 2048 M03	`2024-09-24` - `2025-10-23`	a year	crt.sh
log.intellimize.co Amazon RSA 2048 M03	`2024-09-23` - `2025-10-22`	a year	crt.sh
zoominfo.com E5	`2024-12-10` - `2025-03-10`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Frame ID: 7A6C64CBD058E8E39060C8C0AB0C90CF
Requests: 134 HTTP requests in this frame

Frame: https://info.zscaler.com/index.php/form/XDFrame
Frame ID: 467CD9164578B16E8C94F62DBB4E19BC
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: 514A33BABDB5394C4AA46B97610DF254
Requests: 2 HTTP requests in this frame

Frame: https://117186981.intellimizeio.com/storage.html
Frame ID: A7426395229E1A91CBBC87B27D20BBC0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Technical Analysis of Zloader 2.9.0.4 | ThreatLabz

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

144
Requests

95 %
HTTPS

37 %
IPv6

21
Domains

34
Subdomains

30
IPs

5
Countries

2316 kB
Transfer

6983 kB
Size

23
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://threatlabz.zscaler.com/
Title: ThreatLabz

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/phone-support
Title: Support

Search URL Search Domain Scan URL

URL: https://admin.zscaler.net/
Title: Zscaler Cloud Portal | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerone.net/
Title: Zscaler Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalertwo.net/
Title: Zscaler Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerthree.net/
Title: Zscaler Cloud Portal Three | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerbeta.net/
Title: Zscaler Cloud Portal Beta | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscloud.net/
Title: admin.zscloud.net

Search URL Search Domain Scan URL

URL: https://admin.private.zscaler.com/
Title: Zscaler Private Access Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zpatwo.net/
Title: Zscaler Private Access Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://partners.zscaler.com/s/partneronboarding
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://threatlabz.zscaler.com/cloud-insights/cloud-activity-dashboard
Title: ThreatLabz Analytics

Search URL Search Domain Scan URL

URL: http://securitypreview.zscaler.com/
Title: Security Preview

Search URL Search Domain Scan URL

URL: https://customer.zscaler.com/
Title: Customer Success Center

Search URL Search Domain Scan URL

URL: https://community.zscaler.com/
Title: Zenith Community

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/
Title: Zscaler Help Portal

Search URL Search Domain Scan URL

URL: https://ir.zscaler.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://tinyurl.com/2y7jxsyk

Search URL Search Domain Scan URL

URL: https://x.com/intent/tweet?text=https://tinyurl.com/2y7jxsyk%20%E2%80%94%20Inside%20Zloader%E2%80%99s%20Latest%20Trick%3A%20DNS%20Tunneling%22

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://tinyurl.com/2y7jxsyk

Search URL Search Domain Scan URL

URL: https://medium.com/walmartglobaltech/unknown-powershell-backdoor-with-ties-to-new-zloader-88ca51d38850
Title: Open source reporting

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a
Title: CISA

Search URL Search Domain Scan URL

URL: https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/
Title: Rapid7

Search URL Search Domain Scan URL

URL: https://threatlibrary.zscaler.com/threats/685e24cf-046e-412f-96cd-6031f9e7fcde
Title: Win64.Downloader.Zloader

Search URL Search Domain Scan URL

URL: https://www.facebook.com/zscaler
Title: Visit us on Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zscaler
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://x.com/zscaler
Title: Follow us on X

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/ZscalerMarketing
Title: Subscribe our Youtube Channel

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 87

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIjMvP4pCnigMVVu0RCB2MlxlKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8 HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIjMvP4pCnigMVVu0RCB2MlxlKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dm7S5uX3DPpMtpA15qZ5AgjjZ4LrwCQ&random=3502118542 HTTP 302
https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIjMvP4pCnigMVVu0RCB2MlxlKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dm7S5uX3DPpMtpA15qZ5AgjjZ4LrwCQ&random=3502118542&ipr=y

Request Chain 102

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=431467747.1734174857&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVdHJpZ2dlciwgZXZlbnQtc291cmNlWgMKAQFiBAoCAgM&pscrd=IhMIourT4pCnigMVx-8RCB2roxWlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU0SmZuUHJaRWhzcXI4c1lsSlphSno3ckVPSXE1UmRmNDhHSkllaHJJbkIwWGdhRkkyYXVudw HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=431467747.1734174857&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVdHJpZ2dlciwgZXZlbnQtc291cmNlWgMKAQFiBAoCAgM&pscrd=IhMIourT4pCnigMVx-8RCB2roxWlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU0SmZuUHJaRWhzcXI4c1lsSlphSno3ckVPSXE1UmRmNDhHSkllaHJJbkIwWGdhRkkyYXVudw&is_vtc=1&cid=CAQSKQCa7L7d66TZjvaBwnD2zj8MAYToMy8FRPK2-vlTIBSsIr8VIKIsHS1X&random=716754586 HTTP 302
https://www.google.de/pagead/1p-conversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=431467747.1734174857&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVdHJpZ2dlciwgZXZlbnQtc291cmNlWgMKAQFiBAoCAgM&pscrd=IhMIourT4pCnigMVx-8RCB2roxWlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU0SmZuUHJaRWhzcXI4c1lsSlphSno3ckVPSXE1UmRmNDhHSkllaHJJbkIwWGdhRkkyYXVudw&is_vtc=1&cid=CAQSKQCa7L7d66TZjvaBwnD2zj8MAYToMy8FRPK2-vlTIBSsIr8VIKIsHS1X&random=716754586&ipr=y

144 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request inside-zloader-s-latest-trick-dns-tunneling Show response
www.zscaler.com/blogs/security-research/ 432 KB
75 KB 256ms
220ms Document
text/html 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

42ad95a1b910ac787059dfabeeef490d91b8185dbd5ae900fe28c98c9412f7d4

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 500
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
cf-cache-status: DYNAMIC
cf-ray: 8f1dc4eb387b03b0-FRA
content-encoding: br
content-security-policy: default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://*.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com *.mountain.com https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://*.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://*.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://*.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://*.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://*.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:15 GMT
netlify-vary: query=__nextDataReq,header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data
server: cloudflare
strict-transport-security: max-age=31536000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN https://cms.zscaler.com
x-nextjs-date: Sat, 14 Dec 2024 11:13:12 GMT
x-nf-request-id: 01JF2E0KTMKTE1EA2DCN2W9Y3Q
x-powered-by: Next.js
x-xss-protection: 1; mode=block

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 40ms
23ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50d93a2c186cbd1032ed973e133713a6dfbbd5f7fba4fb89069350f228ce4d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: UzmBk0Ra4K9he+CwjGKb/g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD1BF06242194D
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 16789
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/javascript
last-modified: Sat, 14 Dec 2024 03:35:41 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8f37caf0-301e-00c3-53d9-4d1ac9000000
cf-ray: 8f1dc4ecc9d0dc62-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7211
x-ms-blob-type: BlockBlob
server: cloudflare

GET image
www.zscaler.com/_next/ 0
0

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ 199 KB
67 KB 184ms
32ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "303ea2-31b73-6265f10fde9e8"
age: 3319
x-content-type-options: nosniff
cf-ray: 8f1dc4edaa282bc0-FRA
expires: Sat, 14 Dec 2024 15:14:15 GMT
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/x-javascript
last-modified: Fri, 08 Nov 2024 04:20:09 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 219e54771de95554-s.p.woff2
www.zscaler.com/_next/static/media/ 37 KB
37 KB 42ms
35ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/219e54771de95554-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "ee94ab2a11412903ad9756e2edb68d05-ssl"
age: 8880
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9ae03b0-FRA
accept-ranges: bytes
content-length: 37876
x-nf-request-id: 01JF2E0M080H1KN81J37PPTE8F
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 86085b213eb89904-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
39 KB 48ms
41ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/86085b213eb89904-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "9430f4d344e4fa79ef6a839ba362694c-ssl"
age: 6973
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9b003b0-FRA
accept-ranges: bytes
content-length: 40264
x-nf-request-id: 01JF2E0KZYPEXA6Y1TRBRVMPGN
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 9cdafb0650413334-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
40 KB 46ms
40ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/9cdafb0650413334-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "aa81c4751d270062c6783d25c81b8021-ssl"
age: 10525
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9b103b0-FRA
accept-ranges: bytes
content-length: 40336
x-nf-request-id: 01JF2E0M0EW60HM7YJEAT08VX1
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 4012cc4b67ad157d-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
10 KB 48ms
42ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/4012cc4b67ad157d-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "93ae142d2bfd17c936f3d91401658758-ssl"
age: 1322
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9b203b0-FRA
accept-ranges: bytes
content-length: 9592
x-nf-request-id: 01JF2E0M0CV1T9QFPNNAAF19T7
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 41998fdc1b8220a0-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
10 KB 45ms
39ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/41998fdc1b8220a0-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "672d4a5030823e96757755c555bf2027-ssl"
age: 42790
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9b303b0-FRA
accept-ranges: bytes
content-length: 9620
x-nf-request-id: 01JF2E0M0F1Z2XZVC9QHEZHCW2
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 edb9f1eb1c1a7ead-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 43ms
37ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/edb9f1eb1c1a7ead-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "e32ff74f0d5d916b5dda832b01fd5fc8-ssl"
age: 42178
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9b403b0-FRA
accept-ranges: bytes
content-length: 8780
x-nf-request-id: 01JF2E0M0ECK8SNV1092782ABX
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 ce9b84dce7581e2b-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 56ms
50ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/ce9b84dce7581e2b-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "067a5289e0e684ba833d5d7b2beb3f51-ssl"
age: 3991
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9b603b0-FRA
accept-ranges: bytes
content-length: 8764
x-nf-request-id: 01JF2E0M0HM4BVHW5EZGT31PP3
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 ec0ab51eef94ed27.css
www.zscaler.com/_next/static/css/ 119 KB
23 KB 39ms
33ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/ec0ab51eef94ed27.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7d91a422c4e10532fdffafa9d64a11dbbfdd0943736eb7cfff5652fa3921b56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"13628a7b1f9d77ec7ee16eb9321f7903-ssl-df"
age: 2984
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9a803b0-FRA
x-nf-request-id: 01JF2E0M057MBHNGS2XKCDTB5K
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 3af0ea8ee1d54b3f.css
www.zscaler.com/_next/static/css/ 80 KB
11 KB 44ms
38ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/3af0ea8ee1d54b3f.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7a807c808a7b103144313c0e6c26f870-ssl-df"
age: 20404
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9aa03b0-FRA
x-nf-request-id: 01JF2E0M0DWBBWQGTR5V5APVKV
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 60ab7ffa9f7999ec.css
www.zscaler.com/_next/static/css/ 849 B
408 B 37ms
31ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/60ab7ffa9f7999ec.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4fd28ce5d07640308fd628361ee9dd2e-ssl"
age: 17152
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9ac03b0-FRA
x-nf-request-id: 01JF2E0M08DM0GZW73FVFK86SJ
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
server: cloudflare

GET
H2 200 54b114f76a2643a4.css
www.zscaler.com/_next/static/css/ 14 KB
2 KB 75ms
69ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/54b114f76a2643a4.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9b8c484af22ed99c9052a8a53f1fb90c-ssl-df"
age: 17151
x-content-type-options: nosniff
cf-ray: 8f1dc4ecb9ad03b0-FRA
x-nf-request-id: 01JF2E0M0G4AV8G2B3RSTWE7SN
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5d77889da123159b.css
www.zscaler.com/_next/static/css/ 12 KB
2 KB 58ms
52ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/5d77889da123159b.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

939dd94ce46c2fc3503254f604250f1874490f419d4e67c6ceee53a2f16cf64f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"fcfc33de0559aa249beb860c95544f28-ssl-df"
age: 13288
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9b903b0-FRA
x-nf-request-id: 01JF2E0M0J421ZE1NW9GZTQQXT
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 4114629b6bc6d7fb.css
www.zscaler.com/_next/static/css/ 5 KB
950 B 50ms
45ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/4114629b6bc6d7fb.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

946afb146fc270d96525d1c7470e1351af1551f9fe87637cc65ea9f2d0246d37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"dd721fa923a83a8785c4556847930301-ssl-df"
age: 44438
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9ba03b0-FRA
x-nf-request-id: 01JF2E0M0JN29G42KFYYXMP7RR
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 455227249223c84c.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 840ms
835ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/455227249223c84c.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"c7271019cbe209844cca8826be137418-ssl-df"
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9bc03b0-FRA
x-nf-request-id: 01JF2E0M0JPQW6HZBHNRNW27RK
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 cbb48fb32911860a.css
www.zscaler.com/_next/static/css/ 19 KB
3 KB 51ms
46ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/cbb48fb32911860a.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

477029b64ea9a0f457b44c1d514c816624370cbddfaff93a2b90e36a52a5974e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"54b05a3a81ec164172cba82a707edd60-ssl-df"
age: 1000
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9be03b0-FRA
x-nf-request-id: 01JF2E0M0M56CF6RPN1Y5ZT1QY
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 d34fc117d4462dbb.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 70ms
66ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/d34fc117d4462dbb.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a2957e3f52eaaa2164c4c260e8a99bde-ssl-df"
age: 30508
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9c003b0-FRA
x-nf-request-id: 01JF2E0M0QB8GV49K3V76DH1HY
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 79723601f4599fef.css
www.zscaler.com/_next/static/css/ 25 KB
4 KB 50ms
45ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/79723601f4599fef.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7314898ae5841be613f65db4ba6b81d17e8a1e2a28cf11c40c0dbfcaa0a9859a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"1f3b977d0905b75df1322c5ebdb23b2d-ssl-df"
age: 622
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9c103b0-FRA
x-nf-request-id: 01JF2E0M0GGHS5CY64MPPMGD71
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1664.9b8ca4ecc35d08d1.js Show response
www.zscaler.com/_next/static/chunks/ 7 KB
3 KB 51ms
47ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1664.9b8ca4ecc35d08d1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1580616e3616a775919fdab1a24b8c5d33dfa8f0e2c4265c0ab192a5bc59c6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"efb7e61c18a537d82656b6e0dd119fbd-ssl-df"
age: 42564
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9c203b0-FRA
x-nf-request-id: 01JF2E0M0KBZQTTD1PVVP0AXK2
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 4974.ad930a913a695af6.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
2 KB 1074ms
1070ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/4974.ad930a913a695af6.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb7aab905facf6c6fceee3cedfae6d685ec490a50103422a2726f92e117429e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"2df9ad71ed4694bb833c1f269b015429-ssl-df"
age: 1
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9c503b0-FRA
x-nf-request-id: 01JF2E0M0CNADEWK6Z1CQP47ZG
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 9955.16e6f491dc3d3e16.js Show response
www.zscaler.com/_next/static/chunks/ 8 KB
3 KB 70ms
66ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9955.16e6f491dc3d3e16.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8228a5e160e09389114752fef88589847b2a2925c2ad447a2a0d1346a154feea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4b29d5b2672ed34edb353d2997a1f1d7-ssl-df"
age: 36053
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9c603b0-FRA
x-nf-request-id: 01JF2E0M0K6VFYDP2RMM2W33K1
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1151.0f7ca30a25f2c8e3.js Show response
www.zscaler.com/_next/static/chunks/ 605 B
486 B 60ms
55ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1151.0f7ca30a25f2c8e3.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

997fddba8851c6cdf1a13ee986e9ffa6b750afc46ee4809b2642d1f70a496706

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"cd53f1d74d232601f2dfaffc8b12f256-ssl"
age: 15761
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9c703b0-FRA
x-nf-request-id: 01JF2E0M0V8SK3SJB1RQ1QABS5
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 9017.74505813881349e1.js Show response
www.zscaler.com/_next/static/chunks/ 115 KB
37 KB 62ms
59ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9017.74505813881349e1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b87b2d30bb74bfe1d30f849caa9318b5c9f2df4216324c4c91e5c301284a50e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a83096a536225490fad1253c28b4bca6-ssl-df"
age: 2656
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9c903b0-FRA
x-nf-request-id: 01JF2E0M0PPZNG5DSR4M35MAJS
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1732.5012f37f5ab7b0c8.js Show response
www.zscaler.com/_next/static/chunks/ 4 KB
2 KB 50ms
46ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1732.5012f37f5ab7b0c8.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e95b3816c967bdd21a6fd5b39e1a0d4190558ea29c3fc301df3cd049ee5b3a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"183e1fe66b759c6ab8b4e8f5215d8b57-ssl-df"
age: 42455
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9ca03b0-FRA
x-nf-request-id: 01JF2E0M0NWKVGT4FPP9ZNHK0F
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 7526.2a7c0172ebdd27ea.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 163ms
159ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7526.2a7c0172ebdd27ea.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55bb56299447bf3276bebf85f43c48b77d0e3bfdfbb6e4b278140d2ce971861

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"baa0680f097c1caa266889b2586630f0-ssl-df"
age: 5925
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9cb03b0-FRA
x-nf-request-id: 01JF2E0M1W1GNTGBGM74CPA2E7
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 9328.ffe81042b943e268.js Show response
www.zscaler.com/_next/static/chunks/ 7 KB
3 KB 70ms
66ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9328.ffe81042b943e268.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5aaf7b9640925e4c588a8aa3a603f77889102f1b367db3becd44acbc5fe3ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"8e4e91507e70f9fcd3d09fdd2fb16046-ssl-df"
age: 18837
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9cc03b0-FRA
x-nf-request-id: 01JF2E0M0PB0F4Q563NB7855N3
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 938.dd59828e1962ef9a.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 56ms
52ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/938.dd59828e1962ef9a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c35f6dd3b0ba20509d10536d6ecb201aa8e4ec53720402c566210f6fc5119770

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a96638234cca20ac23e68f5847269f66-ssl-df"
age: 9390
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9ce03b0-FRA
x-nf-request-id: 01JF2E0M0PPKVYYGSJSCM63S7V
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2120.1d0c960f2160de87.js Show response
www.zscaler.com/_next/static/chunks/ 43 KB
14 KB 80ms
77ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2120.1d0c960f2160de87.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92cad8f27e34bc081537b645a016152ce14c43f4d06870641fc63a34ed398445

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"0e06bf3da788e9863899b11097221a84-ssl-df"
age: 5577
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9cf03b0-FRA
x-nf-request-id: 01JF2E0M0N8XDMM0DJTBGD860B
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 webpack-b78d7c3aa49f6203.js Show response
www.zscaler.com/_next/static/chunks/ 12 KB
6 KB 62ms
59ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd56cd9bfe6aeb270cbe6ba7f18e2e7d10101c34faca85d0eeda54fd37fcde24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"49dc37b53be78b64a042453cab84a86d-ssl-df"
age: 11754
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d003b0-FRA
x-nf-request-id: 01JF2E0M0TSRJCV0W436XZ6FHQ
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 framework-a71af9b1c76f668e.js Show response
www.zscaler.com/_next/static/chunks/ 137 KB
45 KB 60ms
57ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/framework-a71af9b1c76f668e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95574fc190611a6573178d07fb4e40ff98d224fb735648d76faafa20ae6dfbf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"22e6ceed8b1f05efe6213626eb3b2956-ssl-df"
age: 40263
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d103b0-FRA
x-nf-request-id: 01JF2E0M0PWDRF227JKS1YQ5VD
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main-8dadffc346739bd9.js Show response
www.zscaler.com/_next/static/chunks/ 111 KB
33 KB 57ms
54ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f0b15a1afaad3090fcd15f3b85c16f3cd72b58498d099ceda1500749ba0e611

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"f70bb75530f65ad946ebe64c4c5c7271-ssl-df"
age: 52
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d203b0-FRA
x-nf-request-id: 01JF2E0M0MDPE5Y2K1RZ6V9HS1
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _app-2ac8f4988fa93ff1.js Show response
www.zscaler.com/_next/static/chunks/pages/ 421 KB
136 KB 58ms
54ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/_app-2ac8f4988fa93ff1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

345877cdead5971b6dedd246401b2e833e02436e6abc4a254c8531b6cde639cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"ca1f5f3c38901e1c034f7957a3db7fc7-ssl-df"
age: 44260
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d403b0-FRA
x-nf-request-id: 01JF2E0M0HJT5RH64WN4ZB0D8R
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2635-846f40232fe95cc5.js Show response
www.zscaler.com/_next/static/chunks/ 207 KB
56 KB 79ms
76ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2635-846f40232fe95cc5.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ebb64cfb1007ee817bc11299a7a829dfe574d6a1ae4389056b23fbb7d0e1863

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"5e02bd735da1b9b792d5f676af7dcab0-ssl-df"
age: 1295
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d503b0-FRA
x-nf-request-id: 01JF2E0M0VA3G4JPP4ABYPT59H
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 3137-eef5947276778551.js Show response
www.zscaler.com/_next/static/chunks/ 136 KB
38 KB 58ms
55ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/3137-eef5947276778551.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f34dcf4b0199f8e65fb814e549773b31ac54998d949e166432362f35e5cf4ece

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"afbdd3d4922908132dbe45ee55655638-ssl-df"
age: 8051
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d603b0-FRA
x-nf-request-id: 01JF2E0M0MRD7TVG3WJ3C8H5CH
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 7214-5d486d4dcf3ed718.js Show response
www.zscaler.com/_next/static/chunks/ 62 KB
18 KB 50ms
47ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7214-5d486d4dcf3ed718.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

543903cf053c0b027960d51a539f5e0e4b9597de2b7b80c79156d2ee78f5fe7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"ed7d326483aff66b538a9c181d147f2f-ssl-df"
age: 46054
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d803b0-FRA
x-nf-request-id: 01JF2E0M0M0YV3PPYRBM24R3Z1
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2394-4eda273cccb298fb.js Show response
www.zscaler.com/_next/static/chunks/ 141 KB
32 KB 101ms
98ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2394-4eda273cccb298fb.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

754a58487a0b52ac215f05028c3aebf5c50d4340c4f56686fa27e24a8a4382fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"f9ea061fca16793d7be5ec4b346e9230-ssl-df"
age: 20972
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9d903b0-FRA
x-nf-request-id: 01JF2E0M1WC99HV7CV9FQ3F6S7
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 %5B...slug%5D-27d771f84ba00ca1.js Show response
www.zscaler.com/_next/static/chunks/pages/blogs/ 3 KB
2 KB 61ms
58ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/blogs/%5B...slug%5D-27d771f84ba00ca1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c417149b38800590986d283c74fe63b0f47f102c0f31fae6156f7b8e1b1d1d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"1bf2cd4171a2feda477cbe7905a77afb-ssl-df"
age: 41210
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9da03b0-FRA
x-nf-request-id: 01JF2E0M0T5XSZGSX1D7N7XV70
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _buildManifest.js Show response
www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/ 3 KB
1 KB 68ms
65ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/_buildManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a59c1831b74b091c96a1938665c946f4a18a1294cc87867042d7ff5eebc34c79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"b152c1130f16d5c22434039ecd961dcd-ssl-df"
age: 20403
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9db03b0-FRA
x-nf-request-id: 01JF2E0M0W2X1WYSAKMPACE8XV
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _ssgManifest.js Show response
www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/ 449 B
294 B 53ms
51ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/_ssgManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"d483bd250a3ef832dcda9d330b187d08-ssl"
age: 17737
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9dc03b0-FRA
x-nf-request-id: 01JF2E0M0N34D0J4SJJXCHE260
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 email-decode.min.js Show response
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
818 B 29ms
29ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"675318bd-4d7"
x-content-type-options: nosniff
cf-ray: 8f1dc4ecc9dd03b0-FRA
expires: Mon, 16 Dec 2024 11:14:15 GMT
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/javascript
last-modified: Fri, 06 Dec 2024 15:31:09 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: DENY

GET
H2 200 image
www.zscaler.com/_next/ 2 KB
3 KB 82ms
82ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FGartner-report.png&w=256&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f79f5f093b0603e16eb2ca2ac669545bba5eb6ed1155337799dbe1e203f6e27f

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 8053
x-content-type-options: nosniff
cf-ray: 8f1dc4f20dc903b0-FRA
netlify-vary: query=crop|quality|url|fit|fm|w|width|h|timestamp|format|height|position|q
content-length: 2392
x-nf-request-id: 01JF2E0MW65NEH3GFVQ82X0H8R
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 8 KB
8 KB 258ms
257ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FCxo-revolutionaries.png&w=384&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14135d774836383854e7b6bbe9405f82e33786fb0a4663970efaffbc7a59d33d

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f20dcb03b0-FRA
netlify-vary: query=position|crop|fit|fm|format|width|h|height|q|quality|url|w|timestamp
content-length: 7752
x-nf-request-id: 01JF2E0MTEMFQQC0YVBA30JFM8
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 911 B
1 KB 33ms
32ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=%2Fassets%2Fimages%2Fdefault-avatar.png&w=96&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6315be78209cf808f242f765734bbd6c8dbc95b83285fe2bd2978311699d4ff

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 1
x-content-type-options: nosniff
cf-ray: 8f1dc4f20dcc03b0-FRA
netlify-vary: query=w|h|position|quality|url|fit|fm|crop|q|timestamp|format|width|height
content-length: 911
x-nf-request-id: 01JF2E0MTEA9GXR65V63Q1S0FT
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 attack_chain.png
cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/ 25 KB
25 KB 275ms
262ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/attack_chain.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a6b5937200edcb2aad4b81983c3fed49bf9ea80312843bb51435defabeba435

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-cache-status: HIT
etag: "cfDvqSS8RuUIXtTdPBsMhJxajU1gWqs-rDoNB_ezzVDw"
cf-bgj: imgq:85,h2pri
cf-resized: internal=ok/h q=0 n=16+128 c=0+0 v=2024.12.1 l=25296 f=false
warning: cf-images 299 "cache-control is too restrictive"
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: image/avif
last-modified: Thu, 05 Dec 2024 15:28:16 GMT
vary: Accept, Accept-Encoding
strict-transport-security: max-age=31536000; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=300
via: varnish
cf-ray: 8f1dc4f21dd603b0-FRA
accept-ranges: bytes
content-length: 25296
server: cloudflare

GET
H2 200 highlighted_example_0.png
cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/ 25 KB
25 KB 56ms
42ms Image
image/webp 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/highlighted_example_0.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca85d182af9fb895f4c9ac79ed8fdaf091eb3e1bca127ed880ae4ba5d82b60ab

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-cache-status: HIT
etag: "cfVq-0bvmWajWmc_rin24kUbhD1gWqs-rDoNB_ezzVDw"
cf-bgj: imgq:100,h2pri
cf-resized: internal=ok/h q=0 n=19+246 c=0+0 v=2024.10.6 l=25560 f=false
warning: cf-images 299 "cache-control is too restrictive", cf-images 299 "image too large for AVIF"
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: image/webp
last-modified: Wed, 04 Dec 2024 22:38:27 GMT
vary: Accept, Accept-Encoding
strict-transport-security: max-age=31536000; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=300
via: varnish
cf-ray: 8f1dc4f21dd403b0-FRA
accept-ranges: bytes
content-length: 25560
server: cloudflare

GET
H2 200 3e894970-e3e9-4783-85e9-7c38eedbfbbf.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/ 6 KB
2 KB 61ms
24ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/3e894970-e3e9-4783-85e9-7c38eedbfbbf.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c96efc8ef4ae42bb64446649003f53e7bc981a095f07c6ec3807cfcb47039575

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: mWjxWELvqMF6E6na1w5L5g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD1608192F02C6
age: 71613
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sun, 15 Dec 2024 11:14:16 GMT
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Fri, 06 Dec 2024 15:10:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 3a46fb5d-001e-0103-15f0-47d6d8000000
cf-ray: 8f1dc4f23edbd270-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1862
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
295 B 52ms
34ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8f1dc4f28a801941-FRA
access-control-allow-origin: *
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/ 457 KB
111 KB 15ms
15ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9154d414a27fae4611f3f046d25d022a22f4404d1cf169d8f27874d85e0fa2df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: 9aIcs+q+3f1RyS4QXhbzeg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90C1CE91BE
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 5344
x-content-type-options: nosniff
expires: Fri, 29 Nov 2024 09:44:56 GMT
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 09:40:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 6b313eab-701e-002a-7a7a-41e6cf000000
cf-ray: 8f1dc4f2ce9edc62-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 113775
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b08f-7aea-8e5a-bfde3f6faa6f/ 107 KB
21 KB 23ms
23ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b08f-7aea-8e5a-bfde3f6faa6f/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3a62cfed82a22d765eca3edf04342f43569e6a44f7ce94c9e5de91a6880bec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: wJ/pNP4GztY6VIoNjv4sSQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD16081BDA81FE
age: 70095
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sun, 15 Dec 2024 11:14:16 GMT
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Fri, 06 Dec 2024 15:10:23 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: f659f9dd-301e-0062-65f1-47d452000000
cf-ray: 8f1dc4f2f841d270-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21810
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 13 KB
3 KB 18ms
17ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: Zhl3NRfORxoyAD/Z53+4sQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90BE28DCD4
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 4061
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Thu, 28 Nov 2024 09:40:49 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 1f1e55cb-601e-009f-0c31-42eb30000000
cf-ray: 8f1dc4f32898d270-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3003
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/ 64 KB
13 KB 16ms
16ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: iyZIdo3fYGB15RdO1v1ZMQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90BF9D865E
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 43403
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Thu, 28 Nov 2024 09:40:52 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d9b3fe45-801e-001d-5b27-424a60000000
cf-ray: 8f1dc4f32899d270-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 5 KB
2 KB 18ms
18ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: 21eDi1zDDFrr5h445fzg+A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90BF3D82E5
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 8936
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Thu, 28 Nov 2024 09:40:51 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: db83d3e8-d01e-00c2-0219-421b34000000
cf-ray: 8f1dc4f3289bd270-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1738
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 24 KB
4 KB 20ms
20ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 8936
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: text/css
last-modified: Thu, 28 Nov 2024 09:41:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 900259e0-401e-0044-34e9-414fe6000000
cf-ray: 8f1dc4f3289cd270-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
534 B 16ms
16ms Fetch
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 43403
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: image/svg+xml
last-modified: Thu, 12 Dec 2024 20:18:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 510f9333-f01e-00b3-7c1c-4d690d000000
cf-ray: 8f1dc4f358fad270-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 zscaler-variation-icon-white.png
cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/018e5a48-f85f-7774-95d7-08faa6aa3c7b/12ee0f04-1958-4b33-a1d4-12aaee5a0f25/ 1 KB
2 KB 17ms
17ms Image
image/png 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/018e5a48-f85f-7774-95d7-08faa6aa3c7b/12ee0f04-1958-4b33-a1d4-12aaee5a0f25/zscaler-variation-icon-white.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce4e274c5793e7cd62cb67e2630278ef4a470b4baa35cb3b42e145717faed336

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: AjwaatmEihRgIitZTQhd5w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DC4977B36FCFB2
age: 49245
cf-cache-status: HIT
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: image/png
last-modified: Thu, 21 Mar 2024 07:22:44 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 11b1ed99-101e-008a-538e-7b6232000000
cf-ray: 8f1dc4f36812dc62-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1448
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 Zscaler_BrandAssets_LogoLockup.png
cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/256f2a6f-666d-41eb-84f6-97d1c369757f/ba744250-f979-4233-8c6b-e160d7848e92/ 30 KB
31 KB 16ms
16ms Image
image/png 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/256f2a6f-666d-41eb-84f6-97d1c369757f/ba744250-f979-4233-8c6b-e160d7848e92/Zscaler_BrandAssets_LogoLockup.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce99852044b59bb736c57ef96bc2425a82ba6106f9301f9c310733f7fecfcbc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: /KEd6056Cb08C23q097ANg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DC230CCC9CEB69
age: 44838
cf-cache-status: HIT
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: image/png
last-modified: Thu, 01 Feb 2024 10:01:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 7c629476-001e-00a6-7368-efab94000000
cf-ray: 8f1dc4f36815dc62-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31112
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 15ms
15ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 21389
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: image/svg+xml
last-modified: Thu, 12 Dec 2024 20:18:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: b4d749e1-c01e-0038-6b5b-4dd2d3000000
cf-ray: 8f1dc4f36817dc62-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 7763.d758ee891eda7402.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
723 B 21ms
20ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7763.d758ee891eda7402.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"0500e040eba5ed9e5d82333085bd8bd7-ssl-df"
age: 19252
x-content-type-options: nosniff
cf-ray: 8f1dc4f38f0603b0-FRA
x-nf-request-id: 01JF2E0N1YZVWWRS98F7XP9XP3
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5551.c4fb596d5a66633e.js Show response
www.zscaler.com/_next/static/chunks/ 1000 B
711 B 25ms
24ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/5551.c4fb596d5a66633e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"b43ee5b23a7cf90ba2dca725f4930f2a-ssl"
age: 24193
x-content-type-options: nosniff
cf-ray: 8f1dc4f38f0803b0-FRA
x-nf-request-id: 01JF2E0N22ZXMBMD33FW6R61XC
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 6023.ccb3fff03c4fa91a.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
730 B 23ms
22ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6023.ccb3fff03c4fa91a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"39ccbb757c413d78d0f9a1a8014d51bb-ssl-df"
age: 20972
x-content-type-options: nosniff
cf-ray: 8f1dc4f38f0a03b0-FRA
x-nf-request-id: 01JF2E0N1Z6TAGJTYNPFW7GF4K
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 790.d7dc94c2ef6f512f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
912 B 31ms
31ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/790.d7dc94c2ef6f512f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"6ff1ada259784a3388a9c23908ebebdc-ssl-df"
age: 17747
x-content-type-options: nosniff
cf-ray: 8f1dc4f38f0b03b0-FRA
x-nf-request-id: 01JF2E0N25YXZB7C7HGSWF1FY8
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6831.3072668993ea221f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
782 B 33ms
33ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6831.3072668993ea221f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7c416a32791e45716f8ef3dec7caa745-ssl-df"
age: 1908
x-content-type-options: nosniff
cf-ray: 8f1dc4f38f0c03b0-FRA
x-nf-request-id: 01JF2E0N24BV2WP3S51CFAG0GZ
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 19 KB
19 KB 33ms
32ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fimage.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/3137-eef5947276778551.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fd41564413cfe94c87164c2a4902a573843f1e2367ddc93c62485d88b014b11

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 43352
x-content-type-options: nosniff
cf-ray: 8f1dc4f3df6403b0-FRA
netlify-vary: query=format|h|height|position|crop|url|fit|fm|quality|timestamp|w|width|q
content-length: 19050
x-nf-request-id: 01JF2E0N3XY6P9JZX0ZGN1AHX2
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 28 KB
28 KB 23ms
23ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fzloader_cover_image.jpeg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/3137-eef5947276778551.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c88c71934d2e43cf80d7e931804ecec7198178159a4c3888eec974ef26b18534

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 42454
x-content-type-options: nosniff
cf-ray: 8f1dc4f3df6803b0-FRA
netlify-vary: query=height|crop|url|fit|format|w|width|h|quality|timestamp|fm|position|q
content-length: 28288
x-nf-request-id: 01JF2E0N3M6SGEHW4V64K6PJND
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 74 KB
75 KB 233ms
233ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fblog-tile-img-700x467-generic-code.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/3137-eef5947276778551.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c64ed9cbd4857f5cd7171a9f0f6fe9fe619ed237a243d01cda750c3e7b74d484

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f3df6903b0-FRA
netlify-vary: query=fit|format|width|height|quality|crop|q|timestamp|url|fm|w|h|position
content-length: 76013
x-nf-request-id: 01JF2E0N3K1XBC88CJN16ED7J6
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 440 KB
135 KB 80ms
46ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

580d10200c0f7827ee1381f456abacfd966e1dbba56fd3469ca78a46be07a6fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sat, 14 Dec 2024 11:14:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 14 Dec 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 137229
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 3af0ea8ee1d54b3f.css Show response
www.zscaler.com/_next/static/css/ 80 KB
92 B 18ms
18ms Fetch
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/3af0ea8ee1d54b3f.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7a807c808a7b103144313c0e6c26f870-ssl-df"
age: 20404
x-content-type-options: nosniff
cf-ray: 8f1dc4f3ff9403b0-FRA
x-nf-request-id: 01JF2E0N46SAWBEYT0HBG1SSR3
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 238 KB
239 KB 482ms
481ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fremote_work%2520copy.jpeg&w=1920&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

416cb814af7408e0c40053f8834a1a0ff8343f5cb8607699f5ce4d29385d9df1

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f42fb503b0-FRA
netlify-vary: query=w|h|position|quality|url|fit|fm|crop|q|timestamp|format|width|height
content-length: 244202
x-nf-request-id: 01JF2E0N50QR0G1MYMN8S5PHC8
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: image/avif
vary: Accept
server: cloudflare

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 209ms
33ms Script
application/x-javascript 104.82.89.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.82.89.248 Hamburg, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-82-89-248.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Content-Encoding: gzip
ETag: "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 741
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Sat, 14 Dec 2024 11:14:16 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 13 Nov 2024 02:44:39 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 6934ae2b-4c76-4229-97d0-8f637b004b88.js Show response
j.6sc.co/j/ 4 KB
4 KB 396ms
333ms Script
application/javascript 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a2-19-80-120.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-amz-server-side-encryption: AES256
content-type: application/javascript
cache-control: private, max-age=1800
x-amz-version-id: uLuCr1hhLpJjZt0sFSB89FSJa4YqIrE7
etag: "afb8c61166e7f50fe6d7ab7b6377733c"
expires: Sat, 14 Dec 2024 11:44:16 GMT
accept-ranges: bytes
content-length: 3771
x-amz-cf-id: ktWyfvQYCoz3K9gsY-GQA96CWsC-as6UPqlfqUnuEhkBBxIiAnNG9Q==
date: Sat, 14 Dec 2024 11:14:16 GMT
last-modified: Tue, 02 May 2023 17:36:47 GMT
vary: accept-encoding
server: AmazonS3
x-amz-cf-pop: HAM50-C3
x-amz-meta-content-type: application/json

GET
H2 200 1395e54b70b06b444656a2f40c135374.js Show response
ob.iseaskies.com/i/ 104 KB
38 KB 42ms
8ms Script
text/javascript 2600:9000:223e:7600:c:d449:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:7600:c:d449:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Caddy /
Resource Hash: 446fcb4b09d3317056eaf5ea7de5e959d01a60de6a7bc39de340a3f3ba33e17e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: "19fc4-xBKoJRSOLJ2Nz/Z0L9reIUkPIKw"
age: 12434
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
expires: Sat, 14 Dec 2024 19:47:02 GMT
x-cache: Hit from cloudfront
content-length: 38842
x-amz-cf-id: 6L2RtB5tr4IQya0xYXuBhqv3aK1hpl7vWwcERti3Q7FrURVNgSPUdQ==
date: Sat, 14 Dec 2024 07:49:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: Caddy
x-amz-cf-pop: FRA56-P4

GET
H2 200 ct Show response
obs.iseaskies.com/ 4 KB
2 KB 360ms
140ms Script
text/javascript 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/ct?id=60409&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1734174856546&hl=2&op=0&ag=4270235709&rand=84700005018592682150220181865688042810302160066359267820251714192667876857275292190127&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDQ3MTNdLFsiYWJuY2giLDEzXSxbLTgsIi0iXSxbLTE0LCItIl0sWy0zMSwiZmFsc2UiXSxbLTM3LCItMTQ0LTY2LTE4MC0iXSxbLTM5LCJbXCIyMDAzMDEwN1wiLDIsXCJHZWNrb1wiLFwiTmV0c2NhcGVcIixcIk1vemlsbGFcIixudWxsLG51bGwsdHJ1ZSw4LGZhbHNlLG51bGwsNSx0cnVlLHRydWUsbnVsbCwwLHRydWUsdHJ1ZV0iXSxbLTQ4LCIwLDAiXSxbLTcxLCJhMDExMDAxMDEwMDEwMDEwMTAwMDEwMTAwMTExMTEwMTAwMDAxMCJdLFstMTMsIi0iXSxbLTE1LCItIl0sWy0yNCwiW1wic2F5c3dob1wiLDAsMSwxLDFdIl0sWy0zMiwiMiJdLFstNCwiPGh0bWwgbGFuZz1cImVuXCI%2BPGhlYWQ%2BPG1ldGEgY2hhcnNldD1cInV0Zi04XCI%2BPG1ldGEgbmFtZT1cInZpZXdwb3J0XCIgY29udGVudD1cIndpZHRoPWRldmljZS13aWR0aFwiPjxsaW5rIHJlbD1cInByZWNvbm5lY3RcIiBocmVmPVwiLy9pbmZvLnpzY2FsZXIuY29tXCIgY2xhc3M9XCJqc3gtMTM3NTU4NjM0M1wiPjxzY3JpcHQgaWQ9XCJjb29raWVsYXctb3RTREtTdHViLXNjcmlwdFwiIHNyYz1cImh0dHBzOi8vY2RuLmNvb2tpZWxhdy5vcmcvc2NyaXB0dGVtcGxhdGVzL290U0RLU3R1Yi5qc1wiIGRhdGEtbGFuZ3VhZ2U9XCJlblwiIGRhdGEtZG9jdW1lbnQtbGFuZ3VhZ2U9XCJ0cnVlXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGRhdGEtZG9tYWluLXNjcmlwdD1cIjNlODk0OTcwLWUzZTktNDc4My04NWU5LTdjMzhlZWRiZmJiZlwiIGRlZmVyPVwiXCIgY2xhc3M9XCJqc3gtMTM3NTU4NjM0M1wiPjwvc2NyaXB0PjxzY3JpcHQgaWQ9XCJjb29raWVsYXctT3B0YW5vbldyYXBwZXItc2NyaXB0XCIgY2xhc3M9XCJqc3gtMTM3NTU4NjM0M1wiPlxuICAgICAgICAgICAgICAgIGZ1bmN0aW9uIE9wdGFub25XcmFwcGVyKCkgeyBcbiAgICAgICAgICAgIGlmICh3aW5kb3cuT25lVHJ1c3QuSXNBbGVydEJveENsb3NlZCgpKSB7XG4gICAgICAgICAgICAgICAgIWZ1bmN0aW9uKCl7dmFyIGU9d2luZG93LnJ1ZGRlcmFuYWx5dGljcz13aW5kb3cucnVkZGVyYW5hbHl0aWNzfHxbXTtlLm1ldGhvZHM9W1wibG9hZFwiLFwicGFnZVwiLFwidHJhY2tcIixcImlkZW50aWZ5XCIsXCJhbGlhc1wiLFwiZ3JvdXBcIixcInJlYWR5XCIsXCJyZXNldFwiLFwiZ2V0QW5vbnltb3VzSWRcIixcInNldEFub255bW91c0lkXCIsXCJnZXRVc2VySWRcIixcImdldFVzZXJUcmFpdHNcIixcImdldEdyb3VwSWRcIixcImdldEdyb3VwVHJhaXRzXCIsXCJzdGFydFNlc3Npb25cIixcImVuZFNlc3Npb25cIl0sZS5mYWN0b3J5PWZ1bmN0aW9uKHQpe3JldHVybiBmdW5jdGlvbigpe2UucHVzaChbdF0uY29uY2F0KEFycmF5LnByb3RvdHlwZS5zbGljZS5jYWxsKGFyZ3VtZW50cykpKX19O2Zvcih2YXIgdD0wO3Q8ZS5tZXRob2RzLmxlbmd0aDt0Kyspe3ZhciByPWUubWV0aG9kc1t0XTtlW3JdPWUuZmFjdG9yeShyKX1lLmxvYWRKUz1mdW5jdGlvbihlLHQpe3ZhciByPWRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoXCJzY3JpcHRcIik7ci50eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIsci5hc3luYz0hMCxyLnNyYz1cImh0dHBzOi8vY2RuLnJ1ZGRlcmxhYnMuY29tL3YxLjEvcnVkZGVyLWFuYWx5dGljcy5taW4uanNcIjt2YXIgYT1kb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZShcInNjcmlwdFwiKVswXTthLnBhcmVudE5vZGUuaW5zZXJ0QmVmb3JlKHIsYSl9LGUubG9hZEpTKCksIGUubG9hZChcIjJpVzE2Q1lmTVd3NXRDUkRaVmJ5WEdWV0xOUlwiLFwiaHR0cHM6Ly9hbmFseXRpY3MucmV2c3VyZS5jbG91ZC9cIiwge2Nvb2tpZUNvbnNlbnRNYW5hZ2VyOiB7b25lVHJ1c3Q6IHtlbmFibGVkOiB0cnVlfX19KSwgZS5wYWdlKCl9KCk7ICAgICAgICAgICAgICAgIFxuICAgICAgICAgICAgfVxuICAgICAgICB9XG4gICAgICAgICAgICAgIDwvc2NyaXB0Pjx0aXRsZT5UZWNobmljYWwgQW5hbHlzaXMgb2YgWmxvYWRlciAyLjkuMC40IHwgVGhyZWF0TGFiejwvdGl0bGU%2BPG1ldGEgbmFtZT1cImRlc2NyaXB0aW9uXCIgY29udGVudD1cIkRpc2NvdmVyIGhvdyBabG9hZGVyIDIuOS40LjAgaW1wbGVtZW50ZWQgYSBjdXN0b20gRE5TIHR1bm5lbGluZyBwcm90b2NvbCBjb21iaW5lZCB3aXRoIFRMUyBlbmNyeXB0aW9uIHRvIGV2YWRlIG5ldHdvcmsgZGV0ZWN0aW9uLlwiPjxsaW5rIHJlbD1cImNhbm9uaWNhbFwiIGhyZWY9XCJodHRwczovL3d3dy56c2NhbGVyLmNvbS9ibG9ncy9zZWN1cml0eS1yZXNlYXJjaC9pbnNpZGUtemxvYWRlci1zLWxhdGVzdC10cmljay1kbnMtdHVubmVsaW5nXCI%2BPGxpbmsgaHJlZj1cImh0dHBzOi8vd3d3LnpzY2FsZXIuY29tL2Jsb2dzL3NlY3VyaXR5LXJlc2VhcmNoL2luc2lkZS16bG9hZGVyLXMtbGF0ZXN0LXRyaWNrLWRucy10dW5uZWxpbmdcIiByZWw9XCJhbHRlcm5hdGVcIiBocmVmbGFuZz1cImVuXCI%2BPGxpbmsgaHJlZj1cImh0dHBzOi8vd3d3LnpzY2FsZXIuY29tL2ZyL2Jsb2ciXSxbLTYsIntcIndcIjpbXCIxXCIsXCIyXCJdLFwiblwiOltdLFwiZFwiOltdfSJdLFstMjAsIi0iXSxbLTQwLCIzMyJdLFstNDcsIkV1cm9wZS9CZXJsaW4sZGUsbGF0bixncmVnb3J5Il0sWy01NiwibGFuZHNjYXBlLXByaW1hcnkiXSxbLTYyLCI4MCJdLFstNzAsIi0iXSxbMzcsIlszMzE2MjI0MDQ5LGZ1bmN0aW9uKG5ld1ZhbHVlKSB7XG4gICAgICAgICAgICAgIGFkZENvbnRlbnRXaW5kb3dQcm94eSh0aGlzKVxuICAgICAgICAgICAgICAvLyBSZXNldCBwcm9wZXJ0eSwgdGhlIGhvb2sgaXMgb25seSBuZWVkZWQgb25jZVxuICAgICAgICAgICAgICBPYmplY3QuZGVmaW5lUHJvcGVydHkoaWZyYW1lLCAnc3JjZG9jJywge1xuICAgICAgICAgICAgICAgIGNvbmZpZ3VyYWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgd3JpdGFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHZhbHVlOiBfc3JjZG9jXG4gICAgICAgICAgICAgIH0pXG4gICAgICAgICAgICAgIF9pZnJhbWUuc3JjZG9jID0gbmV3VmFsdWVcbiAgICAgICAgICAgIH1dIl0sWy01LCItIl0sWy0zMywiLSJdLFstMTAsIi0iXSxbLTIzLCIrIl0sWy0yNSwiLSJdLFstNDQsIjAsMCwwLDUiXSxbLTQ1LCI2MjAsNjc3LDAsMCwwLDU2MiwwLDAsNjQ4LDAsMCwwLDAsMCwwLDAsMCwwLDAsNjg0LDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwIl0sWy00NiwiMCJdLFstNTQsIntcImhcIjpbXCJfM1wiLFwiMjg3Mjg5OTMyMFwiXSxcImRcIjpbXSxcImJcIjpbXCJfMVwiLFwiMjQyNTY2NTQwMVwiLFwiMTE3NjcyODc4N1wiLFwiMzk1NjEyMzIwN1wiLFwiXzJcIixcIjI4MzI2MDI2NzhcIl0sXCJzXCI6MX0iXSxbLTY1LCItIl0sWy02OSwiTGludXggeDg2XzY0fEdvb2dsZSBJbmMufDh8Mjh8fDAiXSxbLTM4LCJpLC0xLC0xLDAsMCwxLDAsMTUsMjEsMjQxLC0xLDAsMTEzOS42LDExMzkuNiwxNjUyLDE2NTMiXSxbLTUwLCItIl0sWy01MSwiLSJdLFstNTcsIldFMFpWMXhPY1ZoWFhWVmNTeGNGV2xaVVNVeE5YRjBIR1dKWVNobFlTVWxWUUdRWkVWeFBXRlVaV0UwWkJWaFhWbGRBVkZaTVNnY1pFUU1PQXdnTUNRb0pBUkFWR1FWWVYxWlhRRlJXVEVvSEF3Z0JBd29KRUJWWVRSbDRTMHRZUUJkUFhCa1JVVTFOU1VvREZoWldXeGRRU2x4WVNsSlFYRW9YV2xaVUZsQVdDQW9BREZ3TURWc09DVnNKRDFzTkRRMFBEQTlZQzE4TkNWb0lDZ3dLRGcwWFUwb0RDQU1QRGdFSkRoQVZXRTBaU3hrUlVVMU5TVW9ERmhaV1d4ZFFTbHhZU2xKUVhFb1hXbFpVRmxBV0NBb0FERndNRFZzT0NWc0pEMXNORFEwUERBOVlDMThOQ1ZvSUNnd0tEZzBYVTBvRENBTU9DdzBCQVJBPSJdLFstNjEsIntcIndnc2xcIjpcIjQ7cGFja2VkXzR4OF9pbnRlZ2VyX2RvdF9wcm9kdWN0O3VucmVzdHJpY3RlZF9wb2ludGVyX3BhcmFtZXRlcnM7cG9pbnRlcl9jb21wb3NpdGVfYWNjZXNzO3JlYWRvbmx5X2FuZF9yZWFkd3JpdGVfc3RvcmFnZV90ZXh0dXJlcztcIixcInBjZlwiOlwiYmdyYTh1bm9ybVwifSJdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiaW50ZWwgaW5jLlwiLFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjMsXCJ3Z2xcIjoxLFwiZ3JlblwiOlwid2Via2l0IHdlYmdsXCIsXCJzZWZcIjoxOTMwODIwMjc5LFwic2VjXCI6XCJcIn0iXSxbLTEsIi0iXSxbLTcsIi0iXSxbLTE2LCIwIl0sWy0yMSwiLSJdLFstMjIsIltcIm5cIixcIm5cIl0iXSxbLTUyLCItIl0sWy01NSwiMSJdLFstNTgsIi0iXSxbLTU5LCJkZWZhdWx0Il0sWy02NiwiZ2VvbG9jYXRpb24sY2h1YWZ1bGx2ZXJzaW9ubGlzdCxjcm9zc29yaWdpbmlzb2xhdGVkLHNjcmVlbndha2Vsb2NrLHB1YmxpY2tleWNyZWRlbnRpYWxzZ2V0LHNoYXJlZHN0b3JhZ2VzZWxlY3R1cmwsY2h1YWFyY2gsY29tcHV0ZXByZXNzdXJlLGNocHJlZmVyc3JlZHVjZWR0cmFuc3BhcmVuY3ksdXNiLGNoc2F2ZWRhdGEscHVibGlja2V5Y3JlZGVudGlhbHNjcmVhdGUsc2hhcmVkc3RvcmFnZSxydW5hZGF1Y3Rpb24sY2h1YWZvcm1mYWN0b3JzLGNoZG93bmxpbmssb3RwY3JlZGVudGlhbHMscGF5bWVudCxjaHVhLGNodWFtb2RlbCxjaGVjdCxhdXRvcGxheSxjYW1lcmEscHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxhY2NlbGVyb21ldGVyLGNodWFwbGF0Zm9ybXZlcnNpb24saWRsZWRldGVjdGlvbixwcml2YXRlYWdncmVnYXRpb24saW50ZXJlc3Rjb2hvcnQsY2h2aWV3cG9ydGhlaWdodCxsb2NhbGZvbnRzLGNodWFwbGF0Zm9ybSxtaWRpLGNodWFmdWxsdmVyc2lvbix4cnNwYXRpYWx0cmFja2luZyxjbGlwYm9hcmRyZWFkLGdhbWVwYWQsZGlzcGxheWNhcHR1cmUsa2V5Ym9hcmRtYXAsam9pbmFkaW50ZXJlc3Rncm91cCxjaHdpZHRoLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24sYnJvd3Npbmd0b3BpY3MsZW5jcnlwdGVkbWVkaWEsZ3lyb3Njb3BlLHNlcmlhbCxjaHJ0dCxjaHVhbW9iaWxlLHdpbmRvd21hbmFnZW1lbnQsdW5sb2FkLGNoZHByLGNocHJlZmVyc2NvbG9yc2NoZW1lLGNodWF3b3c2NCxhdHRyaWJ1dGlvbnJlcG9ydGluZyxmdWxsc2NyZWVuLGlkZW50aXR5Y3JlZGVudGlhbHNnZXQscHJpdmF0ZXN0YXRldG9rZW5yZWRlbXB0aW9uLGhpZCxjaHVhYml0bmVzcyxzdG9yYWdlYWNjZXNzLHN5bmN4aHIsY2hkZXZpY2VtZW1vcnksY2h2aWV3cG9ydHdpZHRoLHBpY3R1cmVpbnBpY3R1cmUsbWFnbmV0b21ldGVyLGNsaXBib2FyZHdyaXRlLG1pY3JvcGhvbmUiXSxbLTEyLCJudWxsIl0sWy0yNiwie1widGpoc1wiOjM5Nzk3Mjg0LFwidWpoc1wiOjMwMzUxMTgwLFwiamhzbFwiOjQyOTQ3MDUxNTJ9Il0sWy0yNywiWzUwLDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0zNiwiW1wiNC8zXCIsXCI0LzNcIl0iXSxbLTQzLCIwMDAwMDAwMTAxMDAwMDAxMDAxMTEwMTEwMDEwMTEwMTAwMDAwMTAiXSxbLTYwLDIwOF0sWy0zLCJbXCJpbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJpbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJpbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJpbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJpbnRlcm5hbC1wZGYtdmlld2VyXCJdIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwidHdpdHRlcjp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiXX0iXSxbLTM0LCItIl0sWy00MiwiMTcyNDI5NzY1MyJdLFstNTMsIjEwMCJdLFstNjcsIi0iXSxbLTY4LCItIl0sWy05LCIrIl0sWy0xNywiMjgiXSxbLTQxLCItIl0sWyJibmNoIiw0N10sWy0yLCIzLGVBSFdYMS9mM3F6Q3Zia3V5bVF3Z2xJYUYzcElzZ0lJalNRKzhpS2dxSTBvc0lBaXBGRUVRUklrVWdkRVFRcFVvSlNBdENBcVNIOUd5eTdaV1orZXIvZCtlOTJid3NDU0QvMWUiXSxbLTE4LCJbMCwwLDAsMV0iXSxbLTE5LCJbNDAsNDAsNDAsNDAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyODUsMTYwMCwxMjAwLDAsMCwwLDAsXCItXCIsXCItXCIsMTYwMCwxMjAwLDBdIl0sWy0yOCwiZW4tVVMsZW4iXSxbLTI5LCItIl0sWy0zMCwiW1widlwiLDBdIl0sWy0zNSwiWzE3MzQxNzQ4NTY1NDUsLTFdIl0sWy00OSwiLSJdLFstNjMsIjAiXSxbLTY0LCJbMCxcIlwiLFtdXSJdLFsiZGRiIiwiMCwzLDAsNCwwLDAsMCwwLDAsMCwwLDAsMCwwLDIsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDEsMCwwLDAsMCwwLDEsMSwwLDAsMCwwLDAsMCwxLDMsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMiwwLDMsMCwwLDAsMCwwLDAsMCwwLDAsMCwwIl0sWyJjYiIsIjAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDQsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMiwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwzLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCJdXQ%3D%3D&dep=0&pre=0&sdd=&cri=9nUgJNDDD0&pto=1670&ver=62&gac=-&mei=&ap=&fe=1&duid=1.1734174856.zlcz4pnzS3xK00ao&suid=1.1734174856.O5HrnTnVYlJdXcDp&tuid=1.1734174856.wlDKa3ebgji1Zn4X&fbc=-&gtm=WyJPbmVUcnVzdExvYWRlZCIsIk9wdGFub25Mb2FkZWQiLCJPbmVUcnVzdEdyb3Vwc1VwZGF0ZWQiLCJHQTQgSUQgUmVjb3JkaW5nIl0%3D&it=80%2C1566%2C49&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 979703c5f036630444374afe320d0f409c8f52dcbbcc41513b052535c900e24d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: https://www.zscaler.com
content-encoding: gzip
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
content-length: 1372
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: text/javascript

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 7 KB
2 KB 39ms
38ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=7971&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&callback=jQuery371013938194718868302_1734174855346&_=1734174855347
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59b65270cc71f0a94a8f99a7ced2126ad3631dc8fe307bfcd230df9dfa0ec948

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-ray: 8f1dc4f5d8bd2bc0-FRA
cached: true
content-encoding: gzip
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 7 KB
2 KB 47ms
47ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=1944&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&callback=jQuery371013938194718868302_1734174855348&_=1734174855349
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee1f60c1311b9de5f1219e6a8b439e651cf33c7af158a8a11ed1a2a67aabe85e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-ray: 8f1dc4f5d8c02bc0-FRA
cached: true
content-encoding: gzip
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2.css
info.zscaler.com/js/forms2/css/ 13 KB
3 KB 26ms
25ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "301120-3437-62370c030d900"
age: 6398
x-content-type-options: nosniff
cf-ray: 8f1dc4f619092bc0-FRA
expires: Sat, 14 Dec 2024 15:14:16 GMT
accept-ranges: bytes
content-length: 2623
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-round.css
info.zscaler.com/js/forms2/css/ 4 KB
1 KB 28ms
27ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2-theme-round.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "30111f-e46-62370c030d900"
age: 802
x-content-type-options: nosniff
cf-ray: 8f1dc4f6190a2bc0-FRA
expires: Sat, 14 Dec 2024 15:14:16 GMT
accept-ranges: bytes
content-length: 968
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 XDFrame Show response
info.zscaler.com/index.php/form/ Frame 467C 2 KB
864 B 117ms
117ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/index.php/form/XDFrame

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8f1dc4f6794d2bc0-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:16 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ Frame 467C 199 KB
0 0ms
0ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://info.zscaler.com/index.php/form/XDFrame

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "303ea2-31b73-6265f10fde9e8"
age: 3319
x-content-type-options: nosniff
cf-ray: 8f1dc4edaa282bc0-FRA
expires: Sat, 14 Dec 2024 15:14:15 GMT
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/x-javascript
last-modified: Fri, 08 Nov 2024 04:20:09 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 306ms
306ms Script
application/javascript 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111d7"
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 14:14:17 GMT
accept-ranges: bytes
content-length: 18830
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET 41b5bbdb-492c-4574-ba27-fc3a0c833329
https://www.zscaler.com/ Frame 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 434 KB
138 KB 39ms
38ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5d528785f3618decb6f65e6423bd899434ea500695d611356c5e3c271b19c374

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 140696
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 431 KB
137 KB 55ms
54ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

077366521ce78f64029432b053e89c205b8e31a74af1b27e9b66e630054ce02a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 139680
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 46ms
10ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

240355f4e85792fb5c1e46a942e6d797a078d39f8717dfbab666e4e80cb4dd8d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-4HipNzAj' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-4HipNzAj' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=23, mss=1232, tbw=4495, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: 9ueLjRps777Khtl0E4ZPJpFVSjPJzYzvStN9Ym1uGpecUMAtVdwirn8EZl7Q8FU6tech8fGXR8zAAAjKhFnOhw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62283
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 85ms
33ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 78A5FB95D8DC4F00ABD5D5C1E979F684 Ref B: FRA231050416009 Ref C: 2024-12-14T11:14:16Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 305 KB
102 KB 35ms
35ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0bd6b7bfb4a1a9f855dd700a5efbbe20b8f548c0ac6007043fd18416a056f819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 14 Dec 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 104010
x-xss-protection: 0
server: Google Tag Manager

GET
H3

200

/
www.google.de/pagead/1p-conversion/812494211/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxA...
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg...
https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&...

42 B
64 B

30ms
30ms

Image
image/gif

142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIjMvP4pCnigMVVu0RCB2MlxlKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dm7S5uX3DPpMtpA15qZ5AgjjZ4LrwCQ&random=3502118542&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=47541584&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIjMvP4pCnigMVVu0RCB2MlxlKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dm7S5uX3DPpMtpA15qZ5AgjjZ4LrwCQ&random=3502118542&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 tc_imp.gif
obs.iseaskies.com/tracker/ 43 B
79 B 111ms
111ms Image
image/gif 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.iseaskies.com/tracker/tc_imp.gif?e=37dfbd8ee84e001269eac632ee4f8f9b9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5811896d2e17071a10acf9f29f674d828a8b032f3d1ca82d2401d66ddb6a96076257249b01535830565c90bf681b77be26bb25cb43e2916af05265ac5e24721bd805ec46f497d7dd3dbb2807ff2fcaa8556d8e0e3143714493d60264f060b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c44ca4825b6a3e5aa22a76da50eda7cf54a6863c89777256e1d0cd71ed0d906f50732e690b73255015ab2fb523c9bdc05457f54065258fcd135700e5fe6a5142c93aaf62f8ee04572032cbbc5f4c2c935e7c2db59ec489f5e2c7edfaacff4e43e828ee66e9f325dd4fecf7e1910f06439fb914764ecd1a87dd905f74fba8449c519d9d36d9a6d279c9b22da6198cefab6cdb3f11338ae6bf2fbb9234e2bfb94248efe01e0141a54954309da8dcec8cff18021853bd79fa29873f867342483692c978490446adbe462a007e0dc55987aac7b455b1bdd79b10ecac0bf69f79128cc1deec0dad776c14f5361f1591a58724c3e89ec65b3058c9fc964b59966ec9d209adab8af26c1f0e61f3e3eaece1e0a9bb7490251baacf537b6309bf64eadb578e73ee264d741de06c5b42e944235eebcc13e6a7e64436a584e0bb8bfdd2a8b55e601171c77eabe5d818a041ea9e9ace6e5399ca99da894f2bdec59532ead15f5ea003bdd071c4fc5694f6c7eea69ed2a0bc880c260837cd4278db72dcdb80d99670e2120027f0f9dc0e4db3a67549a184592cfd8bbb0c953199fb0bd7e97d3727bd8d614206ae58cda5e22ab3a86589606fe3e9810c7d515f8bb5ffe89dc97c11370e5f23a7d8371a589b1ac12946932084fc83b0954f1fd15ecef5cb1999b990bdf9b95704b6e13ac37b904b454b5826d97354729443c6300e422ccdf570bdf069cdda15d8abb0d9e6861eb5425788de2c30b44ef76f68a11dd0339054ca27c70f6d4866b9e0569c0dc12cb81d997925ec81f157407f81c484e8ed24805a836e7e2d379de97bd72022ff32e79575aad4207bfc6b00a1b917e6387c2c553c3d7b9c64530fa6dea156057d05c63228092164b88d5eacaf0f24ea328ac6ec9379ecc5195fff22a2bfdd90391cbfca0cef0d5c42850d3a57617893592168f07b7b139a2ced1c720f194dffaf3417e97fdf4a700b814fa0e4931493194c72b3c8a34b61e80c7&cri=9nUgJNDDD0&ts=370&cb=1734174856916
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
date: Sat, 14 Dec 2024 11:14:16 GMT
pragma: no-cache
content-type: image/gif

GET 490ddabf-6b81-444e-8611-5fd69c7f8c9f
https://www.zscaler.com/ Frame 0
0

GET
H3 200 1778897272132032 Show response
connect.facebook.net/signals/config/ 81 KB
16 KB 13ms
13ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1778897272132032?v=2.9.179&r=stable&domain=www.zscaler.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

360c57f8451e1175ccb8b7fa599e5d7d4d0a09d51d3de1263a06472a3ab78245

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-4CUlNKYF' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-4CUlNKYF' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=71, mss=1232, tbw=71278, tp=67, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: DZEJuPqWmotiLDJdiDSMC8tAKEBFuP9kPkB/ftDCP99Hv9QpRCE752yd7V4oz5Q9PvPUGDI8Gh7tLDx1EvQYag==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 16515
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H3 200 collect
www.google.com/ccm/ 0
0 88ms
37ms Ping
text/plain 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&scrsrc=www.googletagmanager.com&frm=0&rnd=252966323.1734174857&dt=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&auid=431467747.1734174857&navt=n&npa=1&did=dYWJhMj&gdid=dYWJhMj&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734174857010&tfd=2134&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.18.4 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s22-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/812494211/ 5 KB
3 KB 29ms
29ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/812494211/?random=1734174857016&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=431467747.1734174857&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f2.1e100.net

Software

cafe /

Resource Hash

e8f995afafa13fc7c9afab47ccd0342e8fd47bd1506b00c8c27d534cca30bda2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2671
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 211 KB
76 KB 39ms
38ms Script
application/javascript 142.250.185.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c&gtm=45je4cc1v883639532za200zb71607006

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ffd2368280d703cf893fe59a080f2c2624586e4d218f628b92fe427560937159

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 14 Dec 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 77510
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 55ms
18ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je4cc1v883639532za200zb71607006&_p=1734174856300&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&gdid=dYWJhMj&cid=540763534.1734174857&ecid=1003646157&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1734174857&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&dt=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&en=CQ&_fv=1&_nsi=1&_ss=1&_ee=1&up.cq_category=bots&tfd=2177
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
554 B 82ms
24ms Ping
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-10SPJ4YJL9&cid=540763534.1734174857&gtm=45je4cc1v883639532za200zb71607006&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 85ms
62ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-10SPJ4YJL9&cid=540763534.1734174857&gtm=45je4cc1v883639532za200zb71607006&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=132619064

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 295018432.js Show response
bat.bing.com/p/action/ 363 B
413 B 37ms
36ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/295018432.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a1fec7acc9e28feaa2280cd08d30cab4cac8e9557fb8fb35ab6ffcd1e28fade8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7B28F16060D24AF49B1EAFCB7861F8BF Ref B: FRA231050416009 Ref C: 2024-12-14T11:14:17Z
x-cache: CONFIG_NOCACHE
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 33ms
12ms Image
text/plain 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&rl=&if=false&ts=1734174857065&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=12318&fbp=fb.1.1734174857065.616319903914529530&ler=empty&cdl=API_unavailable&it=1734174856992&coo=false&rqm=GET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=11, rtx=0, c=23, mss=1232, tbw=4542, tp=10, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
195 B 153ms
133ms Image
image/png 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&rl=&if=false&ts=1734174857065&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=12318&fbp=fb.1.1734174857065.616319903914529530&ler=empty&cdl=API_unavailable&it=1734174856992&coo=false&rqm=FGET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7448224297371948069"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: uXIr8smDtHAZkyWi9nkjke/0CHUlS5HRUC168dTI4Ryf6hIKK7wH9vldeoEHCeklgh9irPq9E1Qcq2FahXZHHg==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7448224297371948069", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=10, rtx=0, c=23, mss=1232, tbw=4910, tp=13, tpl=0, uplat=122, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
DATA 200
OK truncated
/ Frame 514A 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 514A 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3

200

/
www.google.de/pagead/1p-conversion/812494211/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&...
https://www.google.com/pagead/1p-conversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1...
https://www.google.de/pagead/1p-conversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&...

42 B
64 B

36ms
35ms

Image
image/gif

142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=431467747.1734174857&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVdHJpZ2dlciwgZXZlbnQtc291cmNlWgMKAQFiBAoCAgM&pscrd=IhMIourT4pCnigMVx-8RCB2roxWlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU0SmZuUHJaRWhzcXI4c1lsSlphSno3ckVPSXE1UmRmNDhHSkllaHJJbkIwWGdhRkkyYXVudw&is_vtc=1&cid=CAQSKQCa7L7d66TZjvaBwnD2zj8MAYToMy8FRPK2-vlTIBSsIr8VIKIsHS1X&random=716754586&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.de/pagead/1p-conversion/812494211/?random=88755136&cv=11&fst=1734174857016&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=431467747.1734174857&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAkoVdHJpZ2dlciwgZXZlbnQtc291cmNlWgMKAQFiBAoCAgM&pscrd=IhMIourT4pCnigMVx-8RCB2roxWlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU0SmZuUHJaRWhzcXI4c1lsSlphSno3ckVPSXE1UmRmNDhHSkllaHJJbkIwWGdhRkkyYXVudw&is_vtc=1&cid=CAQSKQCa7L7d66TZjvaBwnD2zj8MAYToMy8FRPK2-vlTIBSsIr8VIKIsHS1X&random=716754586&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 0
bat.bing.com/action/ 0
287 B 34ms
33ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=295018432&Ver=2&mid=70b8a6fb-5d76-4acf-846a-982726e950e1&bo=1&sid=8edce920ba0c11ef8c1aa703e773fc6f&vid=8edceec0ba0c11efba54999e4ddb572f&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&p=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&r=&lt=1378&evt=pageLoad&sv=1&cdb=AQET&rn=677289

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 07FA572CD6B1411CACC1CFC194FB2D34 Ref B: FRA231050416009 Ref C: 2024-12-14T11:14:17Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 14 Dec 2024 11:14:16 GMT

GET
H2 204 0
bat.bing.com/action/ 0
231 B 86ms
86ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=295018432&Ver=2&mid=70b8a6fb-5d76-4acf-846a-982726e950e1&bo=2&sid=8edce920ba0c11ef8c1aa703e773fc6f&vid=8edceec0ba0c11efba54999e4ddb572f&vids=0&msclkid=N&ec=CHEQ&el=Invalid_Users&ev=0&ea=Invalid_Users&en=Y&p=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&sw=1600&sh=1200&sc=24&evt=custom&cdb=AQET&rn=940091

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3582798545934D359ED774E09B8BE3CD Ref B: FRA231050416009 Ref C: 2024-12-14T11:14:17Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 14 Dec 2024 11:14:16 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 53ms
13ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c&gtm=45je4cc1v883639532za200zb71607006

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
age: 1972
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 12:41:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 10:41:25 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
700 B 57ms
13ms XHR
application/json 185.89.210.122
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.122 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 78.159.108.44; 78.159.108.44; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
an-x-request-uuid: 69f0ceca-c821-469c-b833-9880d2b7461b
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 / Show response
c.6sc.co/ 7 B
193 B 156ms
119ms XHR
text/html 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a2-19-80-120.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.zscaler.com
content-length: 7
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 21 B
310 B 53ms
9ms XHR
text/html 2a02:26f0:7100::210:172
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 2d9b3ce0d853490090ed4f5fe0169e1a20f95ac1912d8eec0937c92f3d05900f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a00:c98:2f00:20:a::5
expires: Sat, 14 Dec 2024 11:14:17 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1734174857196_34603388_129667002_20_797_5_9_219";dur=1
access-control-allow-origin: https://www.zscaler.com
content-length: 21
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/html
vary: Origin

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
419 B 21ms
20ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=601322308&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&ul=de-de&de=UTF-8&dt=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1908505721&gjid=289562247&cid=540763534.1734174857&tid=UA-6177009-1&_gid=1248680418.1734174857&_r=1&gtm=457e4cc1z8883639532za200zb883639532&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&did=dYWJhMj&gdid=dYWJhMj&jsscut=1&npa=1&z=882607703

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.zscaler.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 173ms
130ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:17 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 415ms
375ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:17 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 170ms
130ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22ab9750bca4342498694e239e304dd3a9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%221dc729230d6b8d19bab5e6236d81f60c4dca0823%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%226934ae2b-4c76-4229-97d0-8f637b004b88%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:17 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 760 B
663 B 55ms
38ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 01dbfcc921d5a74b7b9ac6762a811d03deb96ecedf61f5bc8fb56c25995c34c3

Request headers

Authorization: Token 1dc729230d6b8d19bab5e6236d81f60c4dca0823
X-6s-CustomID: WebTag 6934ae2b-4c76-4229-97d0-8f637b004b88
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.zscaler.com
content-length: 404
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 36ms
10ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.zscaler.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Sat, 14 Dec 2024 11:14:17 GMT
timing-allow-origin: https://6sense.com
x-6si-region

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 315ms
288ms Preflight
application/json 13.35.58.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-28.fra60.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Sat, 14 Dec 2024 11:14:17 GMT
via: 1.1 e53a38d449135904e00f29f17c559950.cloudfront.net (CloudFront)
x-amz-apigw-id: Cx1FkHzgoAMEmKg=
x-amz-cf-id: HkWkgV32SvTyc5TZou_mx45w4Ak62Ph0WOfxouGozak5ZFS3hgYwiw==
x-amz-cf-pop: FRA60-P10
x-amzn-requestid: 7a924675-cdb7-4244-a875-647b4fea7b74
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
520 B 167ms
166ms XHR
application/json 13.35.58.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-28.fra60.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.zscaler.com/

Response headers

x-amz-apigw-id: Cx1FlE5oIAMErJg=
x-amzn-trace-id: Root=1-675d6889-351c7d563e0ed0d77892ee71;Parent=621ba68c7649b855;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 6b0b4bf1-e818-4117-a6a8-fccf454de974
via: 1.1 e53a38d449135904e00f29f17c559950.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: 6fKC4pqctN5EnPVwexZJsU0QsLMfqfkgn5jHKQyVE445YaMwuX0S1Q==
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P10
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 115ms
115ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A2431.7000000476837%2C%22duration%22%3A92.60000014305115%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A2431.7000000476837%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A2524.300000190735%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=&d=1&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:17 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 43ms
23ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2316eedc39d2ae71b2098be3e91ad3662cb1b70d42f6c61ebb6ab5beefd919b6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: Q8AFTvKb8EtoOgGtrVmzLCMTAh5swpvC
etag: W/"5b11ce08c51a9e4b3f4bbe37deea19c1"
age: 72942
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Z4970qUuNfW9pavwsMF2PCoow0YZ6vwzdAXbEXxVV5CUn93_mazYpg==
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript
last-modified: Fri, 13 Dec 2024 14:58:23 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
cf-ray: 8f1dc4fc6972d285-FRA
x-amz-cf-pop: FRA56-P4
server: cloudflare

GET
H2 200 117186981.js Show response
cdn.intellimize.co/snippet/ 504 KB
109 KB 114ms
34ms Script
application/javascript 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.intellimize.co/snippet/117186981.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

916031ed0f866bb0c4eedda4543b310d7aaba31e72f398ff5f110e64fbc607a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=0, must-revalidate
content-encoding: gzip
etag: "011f435fde03267ee1d2d691f61988cd2--gzip"
age: 1
x-timer: S1734174858.733785,VS0,VE1
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 111273
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript;charset=utf-8
x-served-by: cache-mad2200093-MAD
x-cache-hits: 1
vary: Intellimize-Namespace, Intellimize-StatusModule, Accept-Encoding

GET
H2 200 favicon-32x32.ico
www.zscaler.com/favicons/ 4 KB
997 B 101ms
101ms Other
image/vnd.microsoft.icon 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/favicons/favicon-32x32.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"875ed25f85201afbfc383f6b833f32c5-ssl"
age: 1907
x-content-type-options: nosniff
cf-ray: 8f1dc4fc4d6903b0-FRA
x-nf-request-id: 01JF2E0PDSV5HP3MH2HNXJX757
date: Sat, 14 Dec 2024 11:14:17 GMT
cache-status: "Netlify Edge"; hit
content-type: image/vnd.microsoft.icon
server: cloudflare

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
614 B 178ms
178ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: de0c84d1eb7b45ce70c9528b1dc52b3f8b0ca8d506a7c653123417c491f3f879

Request headers

Authorization: Bearer e6609b6e9a1669129391
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"cb-LxklXkgqhr8bq6JApQRUXa6uYEk"
apigw-requestid: Cx1FnhcFPHcEP4w=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: Bnq4l-5NluUf05HuSpdOvla5tkNtgsJF1QUx6jVGpRt5Y1Gqk6NIjg==
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
server-timing: cfExtPri
via: 1.1 ed91e9c9d6be32c45c1d670b7d4a6616.cloudfront.net (CloudFront)
cf-ray: 8f1dc4fdbe403664-FRA
access-control-allow-origin: https://www.zscaler.com
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
server: cloudflare

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 188ms
178ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.zscaler.com
alt-svc: h3=":443"; ma=86400
apigw-requestid: Cx1FlhucPHcEPJw=
cf-cache-status: DYNAMIC
cf-ray: 8f1dc4fc9d5e3664-FRA
date: Sat, 14 Dec 2024 11:14:17 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 c9499008aa7e1acd11e9fbc171281d82.cloudfront.net (CloudFront)
x-amz-cf-id: 3HK_IANzekQ5LT_ro78JS7iE2Je4FsIBBVV5PVZDTZq6DGgU5xb2rA==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 storage.html
117186981.intellimizeio.com/ Frame A742 0
0 121ms
42ms Document
text/html 52.214.206.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://117186981.intellimizeio.com/storage.html

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.214.206.65 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-206-65.eu-west-1.compute.amazonaws.com

Software

/ Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 5628
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:17 GMT
etag: W/"15fc-Uk1A5QrccB7iUltcerqKsVx8Uo0"
strict-transport-security: max-age=15552000; includeSubDomains
x-powered-by: Express

POST
H2 200 117186981 Show response
api.intellimize.co/context-v2/ 438 B
589 B 196ms
124ms Fetch
application/json 52.212.252.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/context-v2/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.212.252.64 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-212-252-64.eu-west-1.compute.amazonaws.com

Software

Resource Hash

a31fe19921c84fddf44675e781d95ee053acade42c04abe1a386a8dd0b2714de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
147 B 104ms
102ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
16 B 104ms
103ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

POST
H2 200 user-alias Show response
log.intellimize.co/ 3 B
316 B 533ms
179ms Fetch
application/json 52.89.65.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/user-alias

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.89.65.74 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-89-65-74.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 117186981 Show response
api.intellimize.co/prediction/ 68 B
379 B 41ms
39ms Fetch
application/json 52.212.252.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/prediction/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.212.252.64 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-212-252-64.eu-west-1.compute.amazonaws.com

Software

Resource Hash

172d0870b3f80f484b83c8c88583d04c49aac33d6d6012dca4f779b9a229848d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 49 KB
15 KB 98ms
79ms Script
application/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=A2aW0Q==, md5=JRurSHzL3UB0yE1Wjm0Zqg==
cf-cache-status: DYNAMIC
etag: W/"251bab487ccbdd4074c84d568e6d19aa"
age: 2105
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Sat, 14 Dec 2024 11:39:13 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 50634
server-timing: cfExtPri
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/javascript
last-modified: Wed, 06 Nov 2024 05:44:23 GMT
priority: u=3,i=?0
x-guploader-uploadid: AFiumC6P2ZveJdYbiTYQK5Zma-yjmtJisw6YGWn6H2NWcEr3iLjISmNf5lz7tJNQClx1cqgcOwn2bI0
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
cf-ray: 8f1dc4ff0f7cd2d2-FRA
x-goog-generation: 1730871862939881
server: cloudflare

GET
H3 200 / Show response
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ 3 KB
2 KB 195ms
186ms Fetch
text/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

bfefdbe363cdf2545c594996fb8027b3d63cc658b1fd037c252b96c7178d4497

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: 84e20b72bed1af7f51d81734174857
_vtok: NzguMTU5LjEwOC40NA==
visited-url: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: text/javascript
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8f1dc50009e8d361-FRA
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ Frame 0
0 172ms
152ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url
access-control-allow-origin: https://www.zscaler.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8f1dc4ff0c1d995c-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:18 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H2 200 logger
log.intellimize.co/ 3 B
315 B 516ms
175ms Ping
application/json 52.89.65.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.89.65.74 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-89-65-74.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 logger
log.intellimize.co/ 3 B
316 B 514ms
173ms Ping
application/json 52.89.65.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.89.65.74 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-89-65-74.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 114ms
114ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%221000%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:18 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 321 B
649 B 158ms
157ms Fetch
application/json 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Authorization: bearer 370c892e688e1744cd312ed1426b3a
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"141-mLq6O+j3ZcyvZxAx4AvrvpOh24w"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8f1dc5008b84d361-FRA
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 154ms
154ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.zscaler.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8f1dc4ff8c72995c-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:18 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
BLOB 200
OK 18edbdc4-7f36-4242-be4e-60b05c8365ab Show response
https://www.zscaler.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.zscaler.com/18edbdc4-7f36-4242-be4e-60b05c8365ab
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bfefdbe363cdf2545c594996fb8027b3d63cc658b1fd037c252b96c7178d4497

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/javascript
Content-Length: 3033

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 106ms
106ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:19 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 107ms
106ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 109ms
109ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A19%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:20 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:20 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 109ms
108ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A20%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:21 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:21 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 105ms
101ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:21 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 185ms
185ms Image
image/gif 2.19.80.120
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=b279b41c-6550-4a65-8887-94f958cfb0bf&session=a5d94f78-eadc-4ab4-8d07-b1d21dca777f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A21%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=393e76c2-8fde-491b-833d-22e5e16e8711&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.80.120 Hamburg, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-19-80-120.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:22 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:22 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET app.js
acsbapp.com/apps/app/dist/js/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.zscaler.com
URL: https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fremote_work%2520copy.jpeg&w=3840&q=75

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/41b5bbdb-492c-4574-ba27-fc3a0c833329

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/490ddabf-6b81-444e-8611-5fd69c7f8c9f

Domain: acsbapp.com
URL: https://acsbapp.com/apps/app/dist/js/app.js

Verdicts & Comments Add Verdict or Comment

87 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.info.zscaler.com/	1970-01-21 01:42:56	Name: __cf_bm Value: 0pBsZ9RKrJHVigs.XJbz1Zm_EhyaF3qsvUQJzVUIzbY-1734174855-1.0.1.1-WlDbttPsMsvGvarxLpUQUNwfMvSAx_M9MchYPinEYjDgHb2l8eoeciBjMG6dW0oNIykTf37uhSFOPE7kc8s_yg
.www.zscaler.com/	1970-01-21 10:28:30	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sat+Dec+14+2024+12%3A14%3A16+GMT%2B0100+(Mitteleurop%C3%A4ische+Normalzeit)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&consentId=7baac95c-e399-4a9e-b156-e8e2d073b647&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&groups=C0001%3A1%2CC0005%3A0%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0&hosts=H36%3A1%2CH98%3A1%2CH141%3A1%2CH12%3A0%2CH144%3A0%2CH68%3A0%2CH145%3A0%2CH139%3A0%2CH31%3A0%2CH46%3A0%2CH76%3A0%2CH110%3A0%2CH185%3A0%2CH190%3A0%2CH191%3A0%2CH101%3A0%2CH152%3A0%2CH133%3A0%2CH8%3A0%2CH159%3A0%2CH104%3A0%2CH160%3A0%2CH105%3A0%2CH14%3A0%2CH149%3A0%2CH166%3A0%2CH17%3A0%2CH63%3A0%2CH174%3A0%2CH176%3A0%2CH177%3A0%2CH135%3A0%2CH179%3A0%2CH136%3A0%2CH182%3A0%2CH45%3A0%2CH33%3A0%2CH34%3A0%2CH187%3A0&genVendors=
.zscaler.com/	1970-01-21 03:54:18	Name: _cq_duid Value: 1.1734174856.zlcz4pnzS3xK00ao
.zscaler.com/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1734174856.O5HrnTnVYlJdXcDp
info.zscaler.com/	1969-12-31 23:59:59	Name: BIGipServerabmweb-nginx-app_https Value: !fOOgdV83SUmwtTBT1L58sRLd9whwR7HINMv/GAS7II+verTSHZd4rErEezDpkKowslgSeRr9zjd2cQ==
obs.iseaskies.com/	1970-01-21 09:46:45	Name: cg_uuid Value: 40924327fec5af48a3bb78cc75b3f13d
.zscaler.com/	1970-01-21 03:52:30	Name: _gcl_au Value: 1.1.431467747.1734174857
.zscaler.com/	1970-01-21 11:18:54	Name: _ga_10SPJ4YJL9 Value: GS1.1.1734174857.1.0.1734174857.60.0.1003646157
.zscaler.com/	1970-01-21 03:52:30	Name: _fbp Value: fb.1.1734174857065.616319903914529530
.zscaler.com/	1970-01-21 01:44:21	Name: _uetsid Value: 8edce920ba0c11ef8c1aa703e773fc6f
.zscaler.com/	1970-01-21 11:04:30	Name: _uetvid Value: 8edceec0ba0c11efba54999e4ddb572f
.doubleclick.net/	1970-01-21 11:04:30	Name: IDE Value: AHWqTUkDz2RIrWdw3N5agbZa0G96CkfpsuanxNB9O5FHybldBhezPwWxxvCqLGHw
.zscaler.com/	1970-01-21 11:18:54	Name: _ga Value: GA1.2.540763534.1734174857
.zscaler.com/	1970-01-21 01:44:21	Name: _gid Value: GA1.2.1248680418.1734174857
.zscaler.com/	1970-01-21 01:42:54	Name: _gat_gtag_UA_6177009_1 Value: 1
.bing.com/	1970-01-21 11:04:30	Name: MUID Value: 25E8CB2AEA39689606DDDE7FEBBC69FA
www.zscaler.com/	1970-01-21 11:18:54	Name: _gd_visitor Value: b279b41c-6550-4a65-8887-94f958cfb0bf
www.zscaler.com/	1970-01-21 01:43:09	Name: _gd_session Value: a5d94f78-eadc-4ab4-8d07-b1d21dca777f
.adnxs.com/	1970-01-21 11:18:54	Name: receive-cookie-deprecation Value: 1
www.zscaler.com/	1970-01-21 01:52:59	Name: _an_uid Value: 0
.www.zscaler.com/	1970-01-21 10:28:30	Name: _zitok Value: 84e20b72bed1af7f51d81734174857
.zoominfo.com/	1970-01-21 01:42:56	Name: __cf_bm Value: S7PP2FCgXSEE7e415WoQxc8Hf0Deaz1Nnv5.UJb6gVU-1734174858-1.0.1.1-zGqVPa2HyZ339SXvVIqeVYP1RGgY4U6cJ5mgYu7rRYRn3yR9V6pKImMHMLPzPLtZcxe6D5stoKGDQpwJ04Ee6A
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: Ch2r5CeLT3PCAwpTmW9HB_Ei8mtGfJnrWb2au2hthrY-1734174858151-0.0.1.1-604800000

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling Message: [GroupMarkerNotSet(crbug.com/242999)!:A0301D00D40A0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
worker	verbose	URL: blob:https://www.zscaler.com/41b5bbdb-492c-4574-ba27-fc3a0c833329(Line 1) Message: Error
security	error	URL: https://www.googletagmanager.com/ Message: Refused to frame 'https://www.googletagmanager.com/' because it violates the following Content Security Policy directive: "frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com".
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

117186981.intellimizeio.com
acsbapp.com
api.intellimize.co
b.6sc.co
bat.bing.com
c.6sc.co
cdn.cookielaw.org
cdn.intellimize.co
cms.zscaler.com
connect.facebook.net
eps.6sc.co
geolocation.onetrust.com
googleads.g.doubleclick.net
info.zscaler.com
ipv6.6sc.co
j.6sc.co
js.zi-scripts.com
log.intellimize.co
munchkin.marketo.net
ob.iseaskies.com
obs.iseaskies.com
region1.analytics.google.com
secure.adnxs.com
stats.g.doubleclick.net
v.eps.6sc.co
ws-assets.zoominfo.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.zscaler.com
acsbapp.com
www.zscaler.com
104.16.117.43
104.17.70.206
104.18.37.212
104.82.89.248
13.35.58.28
142.250.185.162
142.250.185.232
142.250.186.35
151.101.194.132
157.240.0.35
157.240.253.1
172.217.18.2
172.217.18.4
185.89.210.122
2.19.80.120
2001:4860:4802:32::36
2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
2600:9000:223e:7600:c:d449:2a40:93a1
2606:4700:4400::ac40:99eb
2606:4700:4400::ac40:9b77
2606:4700::6812:572a
2620:1ec:33::10
2a00:1450:4001:808::200e
2a00:1450:4001:81c::2008
2a00:1450:400c:c00::9c
2a02:26f0:7100::210:172
52.212.252.64
52.214.206.65
52.89.65.74
75.2.108.141
01dbfcc921d5a74b7b9ac6762a811d03deb96ecedf61f5bc8fb56c25995c34c3
02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747
077366521ce78f64029432b053e89c205b8e31a74af1b27e9b66e630054ce02a
0bd6b7bfb4a1a9f855dd700a5efbbe20b8f548c0ac6007043fd18416a056f819
0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3
0e95b3816c967bdd21a6fd5b39e1a0d4190558ea29c3fc301df3cd049ee5b3a0
13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5
14135d774836383854e7b6bbe9405f82e33786fb0a4663970efaffbc7a59d33d
172d0870b3f80f484b83c8c88583d04c49aac33d6d6012dca4f779b9a229848d
1ebb64cfb1007ee817bc11299a7a829dfe574d6a1ae4389056b23fbb7d0e1863
1fd41564413cfe94c87164c2a4902a573843f1e2367ddc93c62485d88b014b11
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
2316eedc39d2ae71b2098be3e91ad3662cb1b70d42f6c61ebb6ab5beefd919b6
240355f4e85792fb5c1e46a942e6d797a078d39f8717dfbab666e4e80cb4dd8d
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175
2d9b3ce0d853490090ed4f5fe0169e1a20f95ac1912d8eec0937c92f3d05900f
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
345877cdead5971b6dedd246401b2e833e02436e6abc4a254c8531b6cde639cd
360c57f8451e1175ccb8b7fa599e5d7d4d0a09d51d3de1263a06472a3ab78245
3c417149b38800590986d283c74fe63b0f47f102c0f31fae6156f7b8e1b1d1d5
416cb814af7408e0c40053f8834a1a0ff8343f5cb8607699f5ce4d29385d9df1
42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c
42ad95a1b910ac787059dfabeeef490d91b8185dbd5ae900fe28c98c9412f7d4
446fcb4b09d3317056eaf5ea7de5e959d01a60de6a7bc39de340a3f3ba33e17e
477029b64ea9a0f457b44c1d514c816624370cbddfaff93a2b90e36a52a5974e
4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06
50d93a2c186cbd1032ed973e133713a6dfbbd5f7fba4fb89069350f228ce4d81
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
543903cf053c0b027960d51a539f5e0e4b9597de2b7b80c79156d2ee78f5fe7b
54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3
56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d
580d10200c0f7827ee1381f456abacfd966e1dbba56fd3469ca78a46be07a6fd
59b65270cc71f0a94a8f99a7ced2126ad3631dc8fe307bfcd230df9dfa0ec948
5a6b5937200edcb2aad4b81983c3fed49bf9ea80312843bb51435defabeba435
5d528785f3618decb6f65e6423bd899434ea500695d611356c5e3c271b19c374
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640
6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b87b2d30bb74bfe1d30f849caa9318b5c9f2df4216324c4c91e5c301284a50e
7314898ae5841be613f65db4ba6b81d17e8a1e2a28cf11c40c0dbfcaa0a9859a
754a58487a0b52ac215f05028c3aebf5c50d4340c4f56686fa27e24a8a4382fc
7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7
7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff
7f0b15a1afaad3090fcd15f3b85c16f3cd72b58498d099ceda1500749ba0e611
8228a5e160e09389114752fef88589847b2a2925c2ad447a2a0d1346a154feea
89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140
89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723
9154d414a27fae4611f3f046d25d022a22f4404d1cf169d8f27874d85e0fa2df
916031ed0f866bb0c4eedda4543b310d7aaba31e72f398ff5f110e64fbc607a9
92cad8f27e34bc081537b645a016152ce14c43f4d06870641fc63a34ed398445
939dd94ce46c2fc3503254f604250f1874490f419d4e67c6ceee53a2f16cf64f
946afb146fc270d96525d1c7470e1351af1551f9fe87637cc65ea9f2d0246d37
95574fc190611a6573178d07fb4e40ff98d224fb735648d76faafa20ae6dfbf4
979703c5f036630444374afe320d0f409c8f52dcbbcc41513b052535c900e24d
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
997fddba8851c6cdf1a13ee986e9ffa6b750afc46ee4809b2642d1f70a496706
9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd
9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc
a1fec7acc9e28feaa2280cd08d30cab4cac8e9557fb8fb35ab6ffcd1e28fade8
a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6
a31fe19921c84fddf44675e781d95ee053acade42c04abe1a386a8dd0b2714de
a59c1831b74b091c96a1938665c946f4a18a1294cc87867042d7ff5eebc34c79
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
b6315be78209cf808f242f765734bbd6c8dbc95b83285fe2bd2978311699d4ff
b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc
bb7aab905facf6c6fceee3cedfae6d685ec490a50103422a2726f92e117429e9
beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac
bfefdbe363cdf2545c594996fb8027b3d63cc658b1fd037c252b96c7178d4497
c1580616e3616a775919fdab1a24b8c5d33dfa8f0e2c4265c0ab192a5bc59c6d
c35f6dd3b0ba20509d10536d6ecb201aa8e4ec53720402c566210f6fc5119770
c3a62cfed82a22d765eca3edf04342f43569e6a44f7ce94c9e5de91a6880bec6
c64ed9cbd4857f5cd7171a9f0f6fe9fe619ed237a243d01cda750c3e7b74d484
c7d91a422c4e10532fdffafa9d64a11dbbfdd0943736eb7cfff5652fa3921b56
c88c71934d2e43cf80d7e931804ecec7198178159a4c3888eec974ef26b18534
c96efc8ef4ae42bb64446649003f53e7bc981a095f07c6ec3807cfcb47039575
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca85d182af9fb895f4c9ac79ed8fdaf091eb3e1bca127ed880ae4ba5d82b60ab
ce4e274c5793e7cd62cb67e2630278ef4a470b4baa35cb3b42e145717faed336
ce99852044b59bb736c57ef96bc2425a82ba6106f9301f9c310733f7fecfcbc1
d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f
d55bb56299447bf3276bebf85f43c48b77d0e3bfdfbb6e4b278140d2ce971861
d5aaf7b9640925e4c588a8aa3a603f77889102f1b367db3becd44acbc5fe3ee5
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de0c84d1eb7b45ce70c9528b1dc52b3f8b0ca8d506a7c653123417c491f3f879
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2
e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb
e8f995afafa13fc7c9afab47ccd0342e8fd47bd1506b00c8c27d534cca30bda2
ee1f60c1311b9de5f1219e6a8b439e651cf33c7af158a8a11ed1a2a67aabe85e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f34dcf4b0199f8e65fb814e549773b31ac54998d949e166432362f35e5cf4ece
f79f5f093b0603e16eb2ca2ac669545bba5eb6ed1155337799dbe1e203f6e27f
f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b
fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c
fd56cd9bfe6aeb270cbe6ba7f18e2e7d10101c34faca85d0eeda54fd37fcde24
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ffd2368280d703cf893fe59a080f2c2624586e4d218f628b92fe427560937159

www.zscaler.com Open in urlscan Pro 2606:4700:4400::ac40:99eb Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

144 Requests

95 %HTTPS

37 %IPv6

21 Domains

34 Subdomains

30 IPs

5 Countries

2316 kBTransfer

6983 kBSize

23 Cookies

30 Outgoing links

Redirected requests

144 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.zscaler.com Open in urlscan Pro
2606:4700:4400::ac40:99eb Public Scan

Screenshot
Live screenshot

Full Image

144
Requests

95 %
HTTPS

37 %
IPv6

21
Domains

34
Subdomains

30
IPs

5
Countries

2316 kB
Transfer

6983 kB
Size

23
Cookies

144 HTTP transactions
2 data transactions