cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Submission: On October 18 via api (October 18th 2019, 11:18:49 pm UTC) from US

Summary HTTP 118 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 15 IPs in 4 countries across 19 domains to perform 118 HTTP transactions. The main IP is 35.188.168.180, located in United States and belongs to GOOGLE - Google LLC, US. The main domain is cofense.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 19th 2019. Valid for: 3 months.

This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
60	35.188.168.180 35.188.168.180	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2600:9000:20e... 2600:9000:20eb:7c00:c:d51b:4400:21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	151.139.128.10 151.139.128.10	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1	2a04:4e42:200... 2a04:4e42:200::729	54113 (FASTLY) (FASTLY - Fastly)
2	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	147.75.84.33 147.75.84.33	54825 (PACKET) (PACKET - Packet Host)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	2a02:26f0:6c0... 2a02:26f0:6c00:2bf::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.111.11.83 23.111.11.83	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
1	147.75.85.25 147.75.85.25	54825 (PACKET) (PACKET - Packet Host)
2	35.174.78.146 35.174.78.146	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
118	15

60 35.188.168.180 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 180.168.188.35.bc.googleusercontent.com

cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:7c00:c:d51b:4400:21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

dsms0mj1bbhn4.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)

k4z6w9b5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::729 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

cdn.ravenjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.33 (Parsippany, United States)

ASN54825 (PACKET - Packet Host, Inc., US)

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:2bf::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.83 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

a.optnmstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.85.25 (Parsippany, United States)

ASN54825 (PACKET - Packet Host, Inc., US)
PTR: pkt-ams-k1-9

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.78.146 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: pi0-lba1-5-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	cofense.com cofense.com	682 KB
6	gstatic.com fonts.gstatic.com	72 KB
6	googleapis.com fonts.googleapis.com	4 KB
2	pardot.com pi.pardot.com	3 KB
2	bing.com bat.bing.com	8 KB
2	hotjar.com static.hotjar.com script.hotjar.com Failed vars.hotjar.com	3 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	stackpathcdn.com k4z6w9b5.stackpathcdn.com	95 KB
2	googletagmanager.com www.googletagmanager.com	63 KB
1	optnmstr.com a.optnmstr.com
1	bizographics.com sjs.bizographics.com	2 KB
1	ravenjs.com cdn.ravenjs.com	14 KB
1	cloudfront.net dsms0mj1bbhn4.cloudfront.net	3 KB
0	cloudflare.com Failed cdnjs.cloudflare.com Failed
0	linkedin.com Failed px.ads.linkedin.com Failed
0	google.com Failed www.google.com Failed
0	sf14g.com Failed t.sf14g.com Failed
0	googleadservices.com Failed www.googleadservices.com Failed
0	shareaholic.net Failed www.shareaholic.net Failed
118	19

	Domain	Requested by
60	cofense.com	cofense.com
6	fonts.gstatic.com	cofense.com
6	fonts.googleapis.com	cofense.com
2	pi.pardot.com	cofense.com pi.pardot.com
2	bat.bing.com	www.googletagmanager.com cofense.com
2	www.google-analytics.com	www.googletagmanager.com cofense.com
2	k4z6w9b5.stackpathcdn.com	dsms0mj1bbhn4.cloudfront.net
2	www.googletagmanager.com	cofense.com
1	vars.hotjar.com	static.hotjar.com
1	a.optnmstr.com	cofense.com
1	sjs.bizographics.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	cdn.ravenjs.com	cofense.com
1	dsms0mj1bbhn4.cloudfront.net	cofense.com
0	script.hotjar.com Failed	static.hotjar.com
0	cdnjs.cloudflare.com Failed	k4z6w9b5.stackpathcdn.com
0	px.ads.linkedin.com Failed	cofense.com
0	www.google.com Failed	cofense.com
0	t.sf14g.com Failed	cofense.com
0	www.googleadservices.com Failed	www.googletagmanager.com
0	www.shareaholic.net Failed	dsms0mj1bbhn4.cloudfront.net
118	21

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
community.cofense.com
cofenselabs.com
go.cofense.com
www.arnnet.com.au
www.techradar.com
www.zdnet.com
threatpost.com
www.wpdownloadmanager.com

Subject Issuer	Validity	Valid
cofense.com Let's Encrypt Authority X3	`2019-08-19` - `2019-11-17`	3 months	crt.sh
*.googleapis.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
*.stackpathcdn.com Go Daddy Secure Certificate Authority - G2	`2019-06-27` - `2021-06-27`	2 years	crt.sh
osff.map.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-10-14` - `2020-01-23`	3 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2019-10-06` - `2020-01-04`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
*.optnmstr.com Go Daddy Secure Certificate Authority - G2	`2018-12-13` - `2020-12-13`	2 years	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2019-10-06` - `2020-01-04`	3 months	crt.sh
*.pardot.com DigiCert SHA2 Secure Server CA	`2019-01-21` - `2020-01-22`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Frame ID: 10D729D923EA5C9497B49FCA66949AEE
Requests: 113 HTTP requests in this frame

Frame: https://cdn.ravenjs.com/3.26.4/raven.min.js
Frame ID: F3B20DEDA50425C953F385B3BADE321E
Requests: 4 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-74dcf4e32eff343c96838bf3a780ac1d.html
Frame ID: BDC76A922F6369F347D3875E1457CA55
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /^\/\/static\.hotjar\.com\/c\/hotjar-/i

Page Statistics

118
Requests

75 %
HTTPS

57 %
IPv6

19
Domains

21
Subdomains

15
IPs

4
Countries

965 kB
Transfer

3798 kB
Size

6
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/cofense

Search URL Search Domain Scan URL

URL: https://twitter.com/cofense

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/11500065/

Search URL Search Domain Scan URL

URL: https://community.cofense.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://cofenselabs.com/
Title: Cofense Labs Innovative Research and Development

Search URL Search Domain Scan URL

URL: https://go.cofense.com/live-demo/
Title: Request a Demo

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://cofense.com/emotet-malicious-phishing-campaigns-return-force/&title=Emotet%20Malicious%20Phishing%20Campaigns%20Return%20in%20Force&source=https://cofense.com
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Emotet%20Malicious%20Phishing%20Campaigns%20Return%20in%20Force&url=https://cofense.com/emotet-malicious-phishing-campaigns-return-force/&via=cofense
Title:

Search URL Search Domain Scan URL

URL: https://www.arnnet.com.au/brand-post/content/667347/the-forces-driving-adoption-of-new-managed-phishing-defence-services/
Title: 14-Oct-19 The forces driving adoption of new managed phishing defense services ARN

Search URL Search Domain Scan URL

URL: https://www.techradar.com/news/sextortion-scheme-changes-cryptocurrencies-to-cover-its-tracks
Title: 10-Oct-19 Sextortion scheme changes cryptocurrencies to cover its tracks TechRadar

Search URL Search Domain Scan URL

URL: https://www.zdnet.com/article/new-sextortion-campaign-taps-altcoins-to-avoid-detection/
Title: 08-Oct-2019 New Sextortion Campaign Taps Altcoins to Avoid Detection ZDNet

Search URL Search Domain Scan URL

URL: https://threatpost.com/sextortionists-defenses-cryptocurrency-shift/148967/
Title: 08-Oct-19 Sextortionists Get Past Defenses with Cryptocurrency Shift Threat Post

Search URL Search Domain Scan URL

URL: http://www.wpdownloadmanager.com/
Title: WordPress Download Manager - Best Download Management Plugin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 107

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-114787942-1&cid=114354251.1571440713&jid=836633780&gjid=719933570&_gid=969188300.1571440713&_u=YGBAgUAB~&z=1116699827 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=114354251.1571440713&jid=836633780&_v=j79&z=1116699827

118 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cofense.com/emotet-malicious-phishing-campaigns-return-force/ 144 KB
25 KB 360ms
132ms Document
text/html 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: bd22fe292f1874fde7fdfe744fcb3ed41ae1488d33a88496e6fe1bd2a588d815

Request headers

:method: GET
:authority: cofense.com
:scheme: https
:path: /emotet-malicious-phishing-campaigns-return-force/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Fri, 18 Oct 2019 23:18:32 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
link: <https://cofense.com/?p=17373>; rel=shortlink
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 1
x-pass-why
x-cache-group: normal
content-encoding: gzip

GET
H2 200 cache.skin.css
cofense.com/wp-content/plugins/mega_main_menu/src/css/ 213 B
413 B 118ms
112ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega_main_menu/src/css/cache.skin.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
last-modified: Thu, 17 Oct 2019 12:25:33 GMT
server: nginx
status: 200
etag: "5da85dbd-d5"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 213

GET
H2 200 style.min.css
cofense.com/wp-includes/css/dist/block-library/ 29 KB
5 KB 119ms
114ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/css/dist/block-library/style.min.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Mon, 22 Apr 2019 12:40:04 GMT
server: nginx
status: 200
etag: W/"5cbdb624-726f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.min.css
cofense.com/wp-content/plugins/cookie-notice/css/ 3 KB
1 KB 124ms
119ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-c04"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 font-awesome.min.css
cofense.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/ 28 KB
7 KB 135ms
130ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/font-awesome.min.css?ver=5.1.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5abe21f898d69ccc30a452d02b70a828d111204b7c898709c4e74d0620e79451

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:33 GMT
server: nginx
status: 200
etag: W/"5da85dbd-713a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.css
cofense.com/wp-content/plugins/download-manager/assets/bootstrap/css/ 149 KB
20 KB 161ms
156ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/bootstrap/css/bootstrap.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 77565a00d3b86cbbd914224f423cdb01b2d5db3c3057c2b69209153cc769c8c1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-255bc"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.css
cofense.com/wp-content/plugins/download-manager/assets/css/ 118 KB
34 KB 232ms
227ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/css/front.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ff09631078dd4af25f0cd2647d53311bbab55dc2c0a5045f8a38baf1a9506b41

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-1d8e5"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ihover.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 428 KB
76 KB 273ms
268ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ihover.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:33 GMT
server: nginx
status: 200
etag: W/"5da85dbd-6ae1e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 1 KB
813 B 273ms
268ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/style.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:33 GMT
server: nginx
status: 200
etag: W/"5da85dbd-568"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 font-awesome.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/ 37 KB
8 KB 120ms
115ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/font-awesome.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:33 GMT
server: nginx
status: 200
etag: W/"5da85dbd-9226"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 page-list.css
cofense.com/wp-content/plugins/page-list/css/ 2 KB
778 B 125ms
120ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/page-list/css/page-list.css?ver=5.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:32 GMT
server: nginx
status: 200
etag: W/"5da85dbc-60c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 buttons.css
cofense.com/wp-content/plugins/wpdm-button-templates/ 20 KB
7 KB 273ms
268ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/wpdm-button-templates/buttons.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1febea0d811318da1ca5f4b52b9e406df837c27e79bf633315f5acf33fb54c9c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-4e77"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 pagenavi-css.css
cofense.com/wp-content/plugins/wp-pagenavi/ 374 B
468 B 274ms
269ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-176"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 chosen.min.css
cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/ 10 KB
2 KB 274ms
269ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/chosen.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:31 GMT
server: nginx
status: 200
etag: W/"5da85dbb-29ff"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 search-filter.min.css
cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/ 24 KB
5 KB 274ms
269ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/search-filter.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:31 GMT
server: nginx
status: 200
etag: W/"5da85dbb-61cc"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 magnific-popup.min.css
cofense.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/ 6 KB
2 KB 274ms
269ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/magnific-popup.min.css?ver=0.9.9
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-1802"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 animate.css
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 67 KB
4 KB 274ms
270ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/animate.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-10cbc"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 33ms
16ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C300%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

373a0505368dab061278aa0b7243dc58fc165a25f8b0286d57f8835d06ab6e27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 18 Oct 2019 23:18:32 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 18 Oct 2019 23:18:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:32 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
580 B 41ms
24ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat%3A400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

4c940a58b40018214ca32665ff4cf755522b32a027b309cccb950ccd22e27637

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 18 Oct 2019 23:18:32 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 18 Oct 2019 23:18:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:32 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
467 B 40ms
24ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

16ad30dc7c52842f580962e62e29bd0474f9d3d99c93c81b8d384bdb52553719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 18 Oct 2019 23:18:32 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 18 Oct 2019 23:18:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:32 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
458 B 41ms
25ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 18 Oct 2019 23:18:32 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 18 Oct 2019 23:18:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:32 GMT

GET
H2 200 font-awesome.min.css
cofense.com/wp-content/themes/copro/css/libs/font-awesome-css/ 21 KB
5 KB 274ms
270ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/font-awesome-css/font-awesome.min.css?ver=4.1.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-55e0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 elegant-icons.min.css
cofense.com/wp-content/themes/copro/css/libs/elegant-icons/ 4 KB
1 KB 274ms
270ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/elegant-icons/elegant-icons.min.css?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-103d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.css
cofense.com/wp-content/themes/copro/css/libs/owl-carousel/ 22 KB
3 KB 274ms
270ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-577a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-styles.css
cofense.com/wp-content/themes/copro/css/ 608 KB
72 KB 274ms
270ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:30 GMT
server: nginx
status: 200
etag: W/"5da85dba-980d1"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-shortcodes.css
cofense.com/wp-content/themes/copro/css/ 28 KB
5 KB 275ms
270ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/theme-shortcodes.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-6f98"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom-styles.css
cofense.com/wp-content/themes/copro/css/ 109 KB
18 KB 275ms
271ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1571315129
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 02b5728af616b0e28cc34dec506dc3ed5c94c4963cfd27056a5bebcdea0a8487

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-1b235"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wmx-styles.css
cofense.com/wp-content/themes/copro/css/ 5 KB
1 KB 275ms
271ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/wmx-styles.css?ver=1571315129
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-1572"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 responsive.css
cofense.com/wp-content/themes/copro/css/ 102 KB
12 KB 275ms
271ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/responsive.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-198c3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.css
cofense.com/wp-content/themes/copro/css/vendor/ 15 KB
2 KB 275ms
271ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/vendor/select2.min.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-3aed"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
cofense.com/wp-content/themes/copro/ 96 KB
16 KB 275ms
271ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/style.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2348b89c8b4ad214b3588b7a5c0f898f7366ffd81e21de46ecc29d16a1722aa8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-17fee"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 fancybox.min.css
cofense.com/wp-content/themes/copro/css/vendor/ 12 KB
3 KB 275ms
271ms Stylesheet
text/css 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/vendor/fancybox.min.css?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-31fb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 28 KB
1 KB 42ms
26ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.4

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 18 Oct 2019 23:18:32 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 18 Oct 2019 23:18:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:32 GMT

GET
H2 200 jquery.js Show response
cofense.com/wp-includes/js/jquery/ 95 KB
34 KB 275ms
272ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Fri, 17 May 2019 17:08:53 GMT
server: nginx
status: 200
etag: W/"5cdeeaa5-17a69"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-migrate.min.js Show response
cofense.com/wp-includes/js/jquery/ 10 KB
4 KB 275ms
272ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2016 06:11:28 GMT
server: nginx
status: 200
etag: W/"573eaa90-2748"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.min.js Show response
cofense.com/wp-content/plugins/cookie-notice/js/ 5 KB
1 KB 275ms
272ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=1.2.45
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-14f0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.min.js Show response
cofense.com/wp-content/plugins/download-manager/assets/bootstrap/js/ 35 KB
10 KB 275ms
272ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/bootstrap/js/bootstrap.min.js?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4b9329f540f2a0a583e6b0dff71f0f68d819ca3920c752fdb4e6bb1f88659cab

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-8c73"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
cofense.com/wp-content/plugins/download-manager/assets/js/ 9 KB
3 KB 276ms
272ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/js/front.js?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0e72d4d7a1516d01d305645685a5c0d11b331e854283eb75fb44a45dfe50bdec

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-23c7"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 equal-height-columns-public.js Show response
cofense.com/wp-content/plugins/equal-height-columns/public/js/ 7 KB
3 KB 276ms
272ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/equal-height-columns/public/js/equal-height-columns-public.js?ver=1.1.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 40709d33f8087ff2d000f33d3be50a7241409eb411af7878dad1707f49cf1db5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-1d33"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 core.min.js Show response
cofense.com/wp-includes/js/jquery/ui/ 4 KB
2 KB 276ms
272ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2016 05:40:34 GMT
server: nginx
status: 200
etag: W/"581acdd2-fa0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 script.js Show response
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/js/ 3 KB
1 KB 276ms
273ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/js/script.js?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:33 GMT
server: nginx
status: 200
etag: W/"5da85dbd-c1c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modernizr.js Show response
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 10 KB
5 KB 276ms
273ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-283b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 share-buttons.js Show response
cofense.com/wp-content/themes/copro/js/ 3 KB
1 KB 276ms
273ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/share-buttons.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: faa4537366f405c58904225222e7f6f69af074f1e10a3a424cac9d78d6c4189f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-a24"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 fancybox.min.js Show response
cofense.com/wp-content/themes/copro/js/vendor/ 67 KB
22 KB 276ms
273ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/vendor/fancybox.min.js?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-10a9d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 shareaholic.js Show response
dsms0mj1bbhn4.cloudfront.net/assets/pub/ 7 KB
3 KB 23ms
6ms Script
application/javascript 2600:9000:20eb:7c00:c:d51b:4400:21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:7c00:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 896217bc9c05bde959f4f45d4733ca78a3e8f83feadd7c9c80ef9743959076e6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:13 GMT
content-encoding: gzip
age: 19
x-cache: Hit from cloudfront
status: 200
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 2988
access-control-allow-origin: *
last-modified: Fri, 18 Oct 2019 20:01:26 GMT
server: nginx
etag: "5b225014fa94a72c771b84f710f270e4"
content-type: application/javascript
via: 1.1 3df1d6f6e1999cb29078ddff1a62bd1d.cloudfront.net (CloudFront)
cache-control: max-age=900, public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: Kap0_0rSSLF8v0CSHcxnMA00eY51mUunr_yfg2ghJvykHe1nmZHWCg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 32ms
17ms Script
application/javascript 2a00:1450:4001:81a::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ab68d81f682cff760f450dfd91eab6f25e0374ed6e4fde1c7f5fbc9a22e546e8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: br
last-modified: Fri, 18 Oct 2019 21:00:00 GMT
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28467
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:32 GMT

GET
H2 200 cofense-logo.svg
cofense.com/wp-content/themes/copro/images/ 3 KB
1 KB 143ms
139ms Image
image/svg+xml 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/cofense-logo.svg
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-b20"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cofense-cbfree.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 144ms
140ms Image
image/png 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-cbfree.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
last-modified: Thu, 17 Oct 2019 12:24:47 GMT
server: nginx
status: 200
etag: "5da85d8f-c2a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3114

GET
H2 200 cofense-lms.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 145ms
141ms Image
image/png 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-lms.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
last-modified: Thu, 17 Oct 2019 12:24:47 GMT
server: nginx
status: 200
etag: "5da85d8f-cd3"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3283

GET
H2 200 cofense-reporter.png
cofense.com/wp-content/uploads/2019/01/ 3 KB
3 KB 146ms
142ms Image
image/png 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-reporter.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
last-modified: Thu, 17 Oct 2019 12:24:47 GMT
server: nginx
status: 200
etag: "5da85d8f-b2e"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2862

GET cofense-triage.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-vision.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-pds.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-intelligence.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-anti_phishing.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 104 KB
34 KB 22ms
18ms Script
application/javascript 2a00:1450:4001:81a::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ecb2d35723b9a5c64e1d01548f6a4dbb7b332d482844bb2665ba9c4a8c68ad1a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: br
last-modified: Fri, 18 Oct 2019 21:00:00 GMT
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35193
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:33 GMT

GET wp-emoji-release.min.js
cofense.com/wp-includes/js/ 0
0

GET cofense-tool_free.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-threat_education.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-livefeed.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-cloud_seeker.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-pdc.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET cofense-threat_alerts.png
cofense.com/wp-content/uploads/2019/01/ 0
0

GET sa-emotet-Figure1-480x423.jpg
cofense.com/wp-content/uploads/2019/09/ 0
0

GET Figure2-480x245.jpg
cofense.com/wp-content/uploads/2019/09/ 0
0

GET Figure3-329x480.jpg
cofense.com/wp-content/uploads/2019/09/ 0
0

GET Figure4-1-768x59.jpg
cofense.com/wp-content/uploads/2019/09/ 0
0

GET
H2 200 jquery.form.min.js Show response
cofense.com/wp-includes/js/jquery/ 16 KB
6 KB 247ms
247ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/jquery/jquery.form.min.js?ver=4.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ee1a97f49961f87c6aa495dca24759a1ca097b3c8612401e45c09248fae2fffa

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 14 Feb 2019 00:07:49 GMT
server: nginx
status: 200
etag: W/"5c64b155-4028"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.t-countdown.js Show response
cofense.com/wp-content/plugins/jquery-t-countdown-widget/js/ 9 KB
3 KB 239ms
238ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/jquery-t-countdown-widget/js/jquery.t-countdown.js?ver=2.4.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:33 GMT
server: nginx
status: 200
etag: W/"5da85dbd-23d2"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wow.min.js Show response
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 8 KB
3 KB 112ms
111ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/wow.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-1ff6"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modules.min.js Show response
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 121 KB
35 KB 117ms
117ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modules.min.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-1e4e2"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.js Show response
cofense.com/wp-content/themes/copro/css/libs/owl-carousel/ 38 KB
9 KB 129ms
124ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.js?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-99c8"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.sticky.js Show response
cofense.com/wp-content/themes/copro/js/ 10 KB
3 KB 130ms
125ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/jquery.sticky.js?ver=30
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-2765"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom.js Show response
cofense.com/wp-content/themes/copro/js/ 14 KB
4 KB 138ms
133ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/custom.js?ver=1571315129
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 988698cdde3292e370653b137f03fa593cc4cea173f94e99f2111ed168e87dde

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-3851"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-scripts.js Show response
cofense.com/wp-content/themes/copro/js/ 139 KB
39 KB 124ms
120ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/theme-scripts.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-22de9"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.js Show response
cofense.com/wp-content/themes/copro/js/vendor/ 66 KB
19 KB 138ms
133ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/vendor/select2.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-10964"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.waypoints.min.js Show response
cofense.com/wp-content/themes/copro/js/vendor/ 9 KB
3 KB 140ms
136ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/vendor/jquery.waypoints.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-2344"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 sticky.min.js Show response
cofense.com/wp-content/themes/copro/js/vendor/ 1 KB
817 B 141ms
136ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/vendor/sticky.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: W/"5da85db9-4db"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 comment-reply.min.js Show response
cofense.com/wp-includes/js/ 2 KB
1 KB 143ms
138ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/comment-reply.min.js?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Tue, 05 Mar 2019 01:52:51 GMT
server: nginx
status: 200
etag: W/"5c7dd673-8ba"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
cofense.com/wp-includes/js/ 1 KB
992 B 143ms
139ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/wp-embed.min.js?ver=5.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 30 Aug 2018 12:40:26 GMT
server: nginx
status: 200
etag: W/"5b87e5ba-57b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.json.min.js Show response
cofense.com/wp-content/plugins/gravityforms/js/ 2 KB
1 KB 144ms
139ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-738"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 gravityforms.min.js Show response
cofense.com/wp-content/plugins/gravityforms/js/ 33 KB
10 KB 145ms
141ms Script
application/javascript 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 98984bbc9d46fc5e6ef61b1882e77303377713b957b6ef0f8475ceca54dc6c18

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Thu, 17 Oct 2019 12:25:34 GMT
server: nginx
status: 200
etag: W/"5da85dbe-853b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 5 KB
615 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:300,400,700

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

b1f883af57822077826c9ac07ee32dd79cc07ff96d3115508c12b3c355abf394

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 18 Oct 2019 23:18:32 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 18 Oct 2019 23:18:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 18 Oct 2019 23:18:32 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 18ms
4ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 19:19:03 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:48:04 GMT
server: sffe
age: 359970
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13428
x-xss-protection: 0
expires: Tue, 13 Oct 2020 19:19:03 GMT

GET nav-arrow.png
cofense.com/wp-content/themes/copro/images/ 0
0

GET icn-nav-search@2x.png
cofense.com/wp-content/themes/copro/images/ 0
0

GET
H2 200 b-g.png
cofense.com/wp-content/themes/copro/images/ 80 KB
0 141ms
141ms Image
image/png 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/b-g.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1571315129
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
last-modified: Thu, 17 Oct 2019 12:25:30 GMT
server: nginx
status: 200
etag: "5da85dba-d20af"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 860335

GET footer-graphic.png
cofense.com/wp-content/uploads/2016/07/ 0
0

GET footer-graphic-b.png
cofense.com/wp-content/uploads/2016/07/ 0
0

GET footer-graphic-a.png
cofense.com/wp-content/uploads/2016/07/ 0
0

GET fontawesome-webfont.woff
cofense.com/wp-content/themes/copro/css/libs/fonts/ 0
0

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.4
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 08 Oct 2019 20:54:21 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 872652
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11056
x-xss-protection: 0
expires: Wed, 07 Oct 2020 20:54:21 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.4
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 17:55:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 624198
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11016
x-xss-protection: 0
expires: Sat, 10 Oct 2020 17:55:15 GMT

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 12 KB
12 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.4
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 15 Oct 2019 02:07:24 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 335469
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 12680
x-xss-protection: 0
expires: Wed, 14 Oct 2020 02:07:24 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.4
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 10 Oct 2019 08:23:20 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 744913
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11020
x-xss-protection: 0
expires: Fri, 09 Oct 2020 08:23:20 GMT

GET
H2 200 1Ptrg8zYS_SKggPNwJYtWqZPANqczVs.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptrg8zYS_SKggPNwJYtWqZPANqczVs.woff2

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5c1dde4cdc5c608da53737233f02219a7421ab6870d5d90bc0b7b294d571942c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 16 Oct 2019 05:08:24 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:42 GMT
server: sffe
age: 238209
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13228
x-xss-protection: 0
expires: Thu, 15 Oct 2020 05:08:24 GMT

GET
H2 200 shrMain.min.js Show response
k4z6w9b5.stackpathcdn.com/v2/02faf21b/ 154 KB
47 KB 57ms
18ms Script
application/javascript 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/02faf21b/shrMain.min.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 7814396f2ad7af5d2230e5b3232afcd5bbaa3c2c6fa3c1eb7009d36628dc9395

Request headers

Sec-Fetch-Mode: cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
x-amz-request-id: 63C55F0D9027CD6D
status: 200
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 47983
x-amz-id-2: SAuqnqcmLu0lGjnjR6Bx20dSc+1xmzZIUiCwvpqNdyN996BtKCqabkxD3Ed2XIVPSZv/8q8ecbE=
last-modified: Fri, 18 Oct 2019 20:01:25 GMT
server: nginx
etag: "60be5f20bd45d4990606e340a463dd66"
access-control-max-age: 2000
x-hw: 1571440713.cds084.lo4.hn,1571440713.cds080.lo4.c
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag, Access-Control-Allow-Origin
cache-control: max-age=31536000, public
accept-ranges: bytes

GET
H2 200 raven.min.js Show response
cdn.ravenjs.com/3.26.4/ Frame F3B2 37 KB
14 KB 21ms
6ms Script
application/javascript 2a04:4e42:200::729
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ravenjs.com/3.26.4/raven.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::729 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Fastly /
Resource Hash: 3b6205206b5c515bb685b81ad82ecedf1264a0f1b6b0a99b2d89ce18fe30bc5e

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Fri, 20 Jul 2018 09:10:03 GMT
server: Fastly
age: 64463
etag: "e7a52e3ca61154fb6077ca08d351e3e3"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13757

GET 62df9f201cc7c19a56912daae814efca.json
www.shareaholic.net/config/ 0
0

GET
H2 200 shrMain.min.js Show response
k4z6w9b5.stackpathcdn.com/v2/02faf21b/ Frame F3B2 154 KB
47 KB 52ms
18ms Script
application/javascript 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/02faf21b/shrMain.min.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 7814396f2ad7af5d2230e5b3232afcd5bbaa3c2c6fa3c1eb7009d36628dc9395

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
x-amz-request-id: 63C55F0D9027CD6D
status: 200
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 47983
x-amz-id-2: SAuqnqcmLu0lGjnjR6Bx20dSc+1xmzZIUiCwvpqNdyN996BtKCqabkxD3Ed2XIVPSZv/8q8ecbE=
last-modified: Fri, 18 Oct 2019 20:01:25 GMT
server: nginx
etag: "60be5f20bd45d4990606e340a463dd66"
access-control-max-age: 2000
x-hw: 1571440713.cds062.lo4.hn,1571440713.cds080.lo4.c
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag, Access-Control-Allow-Origin
cache-control: max-age=31536000, public
accept-ranges: bytes

GET conversion_async.js
www.googleadservices.com/pagead/ 0
0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
18 KB 18ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 5063
date: Fri, 18 Oct 2019 21:54:10 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Fri, 18 Oct 2019 23:54:10 GMT

GET
H2 200 hotjar-1312741.js Show response
static.hotjar.com/c/ 6 KB
3 KB 75ms
23ms Script
application/javascript 147.75.84.33
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1312741.js?sv=5

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.84.33 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),

Reverse DNS

Software

openresty /

Resource Hash

e919f07ab48e9452dd02a6430557c5fa9cbf34e99d382a736276f8145519db01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
section-io-tag: hotjar
age: 28
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 2559
server: openresty
cache-control: max-age=60
x-frame-options: SAMEORIGIN
etag: W/9d866318715f4073ca3cc9d3377a8d12
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.068
section-io-id: 75e52d26461df4abeaed0ec6b17ba6c0
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 bat.js Show response
bat.bing.com/ 23 KB
7 KB 76ms
46ms Script
application/javascript 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:32 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 18:57:28 GMT
x-msedge-ref: Ref A: BC2899CFD3E04B439FC80E2A1C174B48 Ref B: VIEEDGE0915 Ref C: 2019-10-18T23:18:33Z
status: 200
etag: "09c5197968d51:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7148

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 3 KB
2 KB 24ms
6ms Script
application/x-javascript 2a02:26f0:6c00:2bf::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:2bf::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 18 Oct 2019 23:18:33 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=45552
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET sf14g.js
t.sf14g.com/ 0
0

GET
H2 200 api.min.js
a.optnmstr.com/app/js/ 56 KB
0 80ms
21ms Script
application/javascript 23.111.11.83
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://a.optnmstr.com/app/js/api.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.83 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
content-encoding: gzip
last-modified: Wed, 02 Oct 2019 19:05:14 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 68D3BE31F2803A67
etag: W/"e160029077c02d0898b0e0008c15cdd6"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=2592000
access-control-allow-origin: *
x-amz-id-2: X0kFfxM26gHCwZGMWK9heZn5dm2y4EWNz+h8xaVdgKrSXIG9fMailoG8gP3NlGPyDXeYPwSNNU4=
expires: Sun, 17 Nov 2019 23:18:33 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
197 B 6ms
6ms Image
image/gif 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j79&aip=1&a=1517730762&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Femotet-malicious-phishing-campaigns-return-force%2F&ul=en-us&de=UTF-8&dt=Emotet%20Malicious%20Phishing%20Campaigns%20Return%20in%20Force%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGBAgUAB~&jid=836633780&gjid=719933570&cid=114354251.1571440713&tid=UA-114787942-1&_gid=969188300.1571440713&gtm=2wgaa05RQ37KH&z=524228146

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Oct 2019 07:39:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 661136
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET

ga-audiences
www.google.com/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-114787942-1&cid=114354251.1571440713&jid=836633780&gjid=719933570&_gid=969188300.1571440713&_u=YGBAgUAB~&z=1116699827
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=114354251.1571440713&jid=836633780&_v=j79&z=1116699827

0
0

GET collect
px.ads.linkedin.com/ 0
0

GET lodash.min.js
cdnjs.cloudflare.com/ajax/libs/lodash.js/3.10.0/ Frame F3B2 0
0

GET most.min.js
cdnjs.cloudflare.com/ajax/libs/most/0.15.0/ Frame F3B2 0
0

GET modules.c8b73d293ba6e2f7c665.js
script.hotjar.com/ 0
0

GET
H2 204 0
bat.bing.com/action/ 0
185 B 84ms
49ms Image
text/plain 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=26041328&Ver=2&mid=f365db9b-197c-c98f-577a-3258c68aaabb&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Emotet%20Malicious%20Phishing%20Campaigns%20Return%20in%20Force%20-%20Cofense&p=https%3A%2F%2Fcofense.com%2Femotet-malicious-phishing-campaigns-return-force%2F&r=&evt=pageLoad&msclkid=N&rn=38399
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 18 Oct 2019 23:18:33 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: DC96A6413B40480BB3693690FE4EC758 Ref B: VIEEDGE0918 Ref C: 2019-10-18T23:18:33Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fontawesome-webfont.ttf
cofense.com/wp-content/themes/copro/css/libs/fonts/ 110 KB
110 KB 429ms
207ms Font
application/octet-stream 35.188.168.180
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/fonts/fontawesome-webfont.ttf?v=4.2.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4d6eb9e9d852a2a6f74e7c428456a2f07fc63a1613d10192d8ed3401d9da5ffa

Request headers

Sec-Fetch-Mode: cors
Referer: https://cofense.com/wp-content/themes/copro/css/libs/font-awesome-css/font-awesome.min.css?ver=4.1.0
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 18 Oct 2019 23:18:33 GMT
last-modified: Thu, 17 Oct 2019 12:25:29 GMT
server: nginx
status: 200
etag: "5da85db9-1b620"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 112160

GET
H2 200 box-74dcf4e32eff343c96838bf3a780ac1d.html
vars.hotjar.com/ Frame BDC7 0
0 70ms
22ms Document
text/html 147.75.85.25
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-74dcf4e32eff343c96838bf3a780ac1d.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.85.25 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS: pkt-ams-k1-9
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-74dcf4e32eff343c96838bf3a780ac1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/

Response headers

status: 200
date: Fri, 18 Oct 2019 23:18:33 GMT
content-type: text/html
content-length: 808
cache-control: max-age=31536000
content-encoding: br
last-modified: Thu, 17 Oct 2019 10:26:51 GMT
etag: "e97b43816dfbff056689db51ae5cdfc7"
section-io-origin-status: 200
section-io-origin-time-seconds: 0.025
vary: Accept-Encoding
accept-ranges: bytes
section-io-id: bf384e83b5411f62cd45cbba7c9c19d3

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 367ms
92ms Script
application/javascript 35.174.78.146
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.78.146 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: pi0-lba1-5-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: f6652dacc3641651bf842bb18861c6fbb66581a3dd2c41dde3226764740684b6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 18 Oct 2019 23:18:34 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: d3d7f55bb0643f40d338b3c1e133d5c5
Last-Modified: Mon, 29 Oct 2018 18:54:35 GMT
Server: PardotServer
ETag: "13e7-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1817
Expires: Sun, 17 Oct 2021 23:18:34 GMT

GET
H/1.0 200
OK analytics Show response
pi.pardot.com/ 1 KB
1 KB 128ms
128ms Script
text/javascript 35.174.78.146
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&pi_opt_in=&campaign_id=1564&account_id=47382&title=Emotet%20Malicious%20Phishing%20Campaigns%20Return%20in%20Force%20-%20Cofense&url=https%3A%2F%2Fcofense.com%2Femotet-malicious-phishing-campaigns-return-force%2F&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.78.146 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: pi0-lba1-5-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 833c5cf77db6f8895e30196e9fbd2b3833e94a61cbfb638a263b19fccaf43536

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://cofense.com/emotet-malicious-phishing-campaigns-return-force/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Oct 2019 23:18:34 GMT
Content-Encoding: gzip
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: d3d7f55bb0643f40d338b3c1e133d5c5
X-Pardot-Rsp: 17/10/254
Vary: Accept-Encoding,User-Agent
P3p: CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 649
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-triage.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-vision.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-pds.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-intelligence.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-anti_phishing.png

Domain: cofense.com
URL: https://cofense.com/wp-includes/js/wp-emoji-release.min.js?ver=5.2.4

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-tool_free.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-threat_education.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-livefeed.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-cloud_seeker.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-pdc.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/01/cofense-threat_alerts.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/09/sa-emotet-Figure1-480x423.jpg

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/09/Figure2-480x245.jpg

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/09/Figure3-329x480.jpg

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2019/09/Figure4-1-768x59.jpg

Domain: cofense.com
URL: https://cofense.com/wp-content/themes/copro/images/nav-arrow.png

Domain: cofense.com
URL: https://cofense.com/wp-content/themes/copro/images/icn-nav-search@2x.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic-b.png

Domain: cofense.com
URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic-a.png

Domain: cofense.com
URL: https://cofense.com/wp-content/themes/copro/css/libs/fonts/fontawesome-webfont.woff?v=4.2.0

Domain: www.shareaholic.net
URL: https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json

Domain: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Domain: t.sf14g.com
URL: https://t.sf14g.com/sf14g.js

Domain: www.google.com
URL: https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=114354251.1571440713&jid=836633780&_v=j79&z=1116699827

Domain: px.ads.linkedin.com
URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&url=https%3A%2F%2Fcofense.com%2Femotet-malicious-phishing-campaigns-return-force%2F&time=1571440713257

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/3.10.0/lodash.min.js

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/most/0.15.0/most.min.js

Domain: script.hotjar.com
URL: https://script.hotjar.com/modules.c8b73d293ba6e2f7c665.js

Verdicts & Comments Add Verdict or Comment

211 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cofense.com/	1970-01-19 04:30:40	Name: _dc_gtm_UA-114787942-1 Value: 1
.cofense.com/	1970-01-19 22:01:52	Name: _ga Value: GA1.2.114354251.1571440713
.cofense.com/	1970-01-19 04:32:07	Name: _gid Value: GA1.2.969188300.1571440713
.cofense.com/	1970-01-19 04:30:42	Name: attr_last Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Femotet-malicious-phishing-campaigns-return-force%2F%22%2C%22date%22%3A%222019-10-19%22%2C%22timestamp%22%3A1571440713226%7D
.cofense.com/	1970-01-19 22:01:52	Name: attr_first Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Femotet-malicious-phishing-campaigns-return-force%2F%22%2C%22date%22%3A%222019-10-19%22%2C%22timestamp%22%3A1571440713226%7D
.cofense.com/	1970-01-19 06:40:16	Name: _gcl_au Value: 1.1.270560489.1571440713

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cofense.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optnmstr.com
bat.bing.com
cdn.ravenjs.com
cdnjs.cloudflare.com
cofense.com
dsms0mj1bbhn4.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
k4z6w9b5.stackpathcdn.com
pi.pardot.com
px.ads.linkedin.com
script.hotjar.com
sjs.bizographics.com
static.hotjar.com
t.sf14g.com
vars.hotjar.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.shareaholic.net
cdnjs.cloudflare.com
cofense.com
px.ads.linkedin.com
script.hotjar.com
t.sf14g.com
www.google.com
www.googleadservices.com
www.shareaholic.net
147.75.84.33
147.75.85.25
151.139.128.10
23.111.11.83
2600:9000:20eb:7c00:c:d51b:4400:21
2620:1ec:c11::200
2a00:1450:4001:809::200a
2a00:1450:4001:814::200e
2a00:1450:4001:816::2003
2a00:1450:4001:81a::2008
2a02:26f0:6c00:2bf::3adf
2a04:4e42:200::729
35.174.78.146
35.188.168.180
02b5728af616b0e28cc34dec506dc3ed5c94c4963cfd27056a5bebcdea0a8487
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0e72d4d7a1516d01d305645685a5c0d11b331e854283eb75fb44a45dfe50bdec
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1
102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0
16ad30dc7c52842f580962e62e29bd0474f9d3d99c93c81b8d384bdb52553719
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1febea0d811318da1ca5f4b52b9e406df837c27e79bf633315f5acf33fb54c9c
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
2348b89c8b4ad214b3588b7a5c0f898f7366ffd81e21de46ecc29d16a1722aa8
2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
373a0505368dab061278aa0b7243dc58fc165a25f8b0286d57f8835d06ab6e27
3b6205206b5c515bb685b81ad82ecedf1264a0f1b6b0a99b2d89ce18fe30bc5e
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
40709d33f8087ff2d000f33d3be50a7241409eb411af7878dad1707f49cf1db5
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
4b9329f540f2a0a583e6b0dff71f0f68d819ca3920c752fdb4e6bb1f88659cab
4c940a58b40018214ca32665ff4cf755522b32a027b309cccb950ccd22e27637
4d6eb9e9d852a2a6f74e7c428456a2f07fc63a1613d10192d8ed3401d9da5ffa
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
5abe21f898d69ccc30a452d02b70a828d111204b7c898709c4e74d0620e79451
5c1dde4cdc5c608da53737233f02219a7421ab6870d5d90bc0b7b294d571942c
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365
77565a00d3b86cbbd914224f423cdb01b2d5db3c3057c2b69209153cc769c8c1
7814396f2ad7af5d2230e5b3232afcd5bbaa3c2c6fa3c1eb7009d36628dc9395
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
833c5cf77db6f8895e30196e9fbd2b3833e94a61cbfb638a263b19fccaf43536
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093
896217bc9c05bde959f4f45d4733ca78a3e8f83feadd7c9c80ef9743959076e6
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504
936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960
988698cdde3292e370653b137f03fa593cc4cea173f94e99f2111ed168e87dde
98984bbc9d46fc5e6ef61b1882e77303377713b957b6ef0f8475ceca54dc6c18
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
ab68d81f682cff760f450dfd91eab6f25e0374ed6e4fde1c7f5fbc9a22e546e8
b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721
b1f883af57822077826c9ac07ee32dd79cc07ff96d3115508c12b3c355abf394
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef
b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00
bd22fe292f1874fde7fdfe744fcb3ed41ae1488d33a88496e6fe1bd2a588d815
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b
c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb
c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d
ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9
cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e
e919f07ab48e9452dd02a6430557c5fa9cbf34e99d382a736276f8145519db01
ecb2d35723b9a5c64e1d01548f6a4dbb7b332d482844bb2665ba9c4a8c68ad1a
ee1a97f49961f87c6aa495dca24759a1ca097b3c8612401e45c09248fae2fffa
f6652dacc3641651bf842bb18861c6fbb66581a3dd2c41dde3226764740684b6
f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6
faa4537366f405c58904225222e7f6f69af074f1e10a3a424cac9d78d6c4189f
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083
ff09631078dd4af25f0cd2647d53311bbab55dc2c0a5045f8a38baf1a9506b41

cofense.com Open in urlscan Pro 35.188.168.180 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

118 Requests

75 %HTTPS

57 %IPv6

19 Domains

21 Subdomains

15 IPs

4 Countries

965 kBTransfer

3798 kBSize

6 Cookies

14 Outgoing links

Redirected requests

118 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Screenshot
Live screenshot

Full Image

118
Requests

75 %
HTTPS

57 %
IPv6

19
Domains

21
Subdomains

15
IPs

4
Countries

965 kB
Transfer

3798 kB
Size

6
Cookies

118 HTTP transactions
0 data transactions