URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-th...
Submission Tags: falconsandbox
Submission: On May 22 via api from US — Scanned from DE

Summary

This website contacted 71 IPs in 8 countries across 61 domains to perform 226 HTTP transactions. The main IP is 2a02:e980:107::cf, located in United States and belongs to INCAPSULA, US. The main domain is www.proofpoint.com. The Cisco Umbrella rank of the primary domain is 212407.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on April 25th 2022. Valid for: a year.
This is the only time www.proofpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification


Live information

Domain & IP information

IP Address AS Autonomous System
23 2a02:e980:107... 19551 (INCAPSULA)
1 2a00:1450:400... 15169 (GOOGLE)
7 104.16.96.80 13335 (CLOUDFLAR...)
2 142.250.185.66 15169 (GOOGLE)
2 2606:4700:440... 13335 (CLOUDFLAR...)
2 104.111.234.67 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 108.138.17.72 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
3 104.75.88.126 16625 (AKAMAI-AS)
1 192.28.144.124 15224 (OMNITURE)
2 18.66.97.20 16509 (AMAZON-02)
2 2 52.213.228.15 16509 (AMAZON-02)
1 2 52.222.214.8 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 199.232.136.157 54113 (FASTLY)
1 108.138.17.96 16509 (AMAZON-02)
5 8 142.250.184.230 15169 (GOOGLE)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
3 5 54.216.196.145 16509 (AMAZON-02)
2 34.96.102.137 15169 (GOOGLE)
5 2606:4700:440... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
64 18.66.112.55 16509 (AMAZON-02)
1 51.11.20.152 8075 (MICROSOFT...)
3 2a03:2880:f02... 32934 (FACEBOOK)
1 2606:4700:440... 13335 (CLOUDFLAR...)
10 96.16.137.162 16625 (AKAMAI-AS)
2 8 2600:9000:225... 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 37.252.173.38 29990 (ASN-APPNEX)
1 2600:9000:249... 16509 (AMAZON-02)
1 1 216.200.122.11 6461 (ZAYO-6461)
4 2a00:1450:400... 15169 (GOOGLE)
1 158.255.109.19 8218 (NEO-ASN l...)
1 3.226.141.76 14618 (AMAZON-AES)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 52.222.236.74 16509 (AMAZON-02)
2 104.244.42.131 13414 (TWITTER)
2 104.244.42.5 13414 (TWITTER)
6 6 2620:1ec:22::14 8068 (MICROSOFT...)
2 13.107.42.14 8068 (MICROSOFT...)
1 18.66.139.84 16509 (AMAZON-02)
1 23.35.237.151 16625 (AKAMAI-AS)
2 3 3.124.34.143 16509 (AMAZON-02)
1 51.75.86.98 16276 (OVH)
1 2a00:1450:400... 15169 (GOOGLE)
1 2620:1ec:27::... 8075 (MICROSOFT...)
1 2.18.233.201 16625 (AKAMAI-AS)
1 66.155.71.149 13768 (COGECO-PEER1)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 206.19.49.24 7018 (ATT-INTER...)
2 3.121.14.2 16509 (AMAZON-02)
12 15 54.220.64.232 16509 (AMAZON-02)
3 2a03:2880:f12... 32934 (FACEBOOK)
4 20.85.30.134 8075 (MICROSOFT...)
1 2 23.35.236.247 16625 (AKAMAI-AS)
1 69.173.144.139 26667 (RUBICONPR...)
1 64.202.112.191 22075 (AS-OUTBRAIN)
1 185.64.190.80 62713 (AS-PUBMATIC)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
1 141.226.228.48 200478 (TABOOLA-AS)
1 2 76.223.111.18 16509 (AMAZON-02)
1 37.252.172.123 29990 (ASN-APPNEX)
1 35.244.159.8 15169 (GOOGLE)
1 1 142.250.186.162 15169 (GOOGLE)
1 151.101.194.137 54113 (FASTLY)
1 2 52.142.114.2 8075 (MICROSOFT...)
1 162.247.243.147 13335 (CLOUDFLAR...)
4 54.147.21.139 14618 (AMAZON-AES)
2 34.193.113.164 14618 (AMAZON-AES)
226 71
Apex Domain
Subdomains
Transfer
64 driftt.com
js.driftt.com — Cisco Umbrella Rank: 5324
754 KB
23 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2620
d.adroll.com — Cisco Umbrella Rank: 1559
33 KB
23 proofpoint.com
www.proofpoint.com — Cisco Umbrella Rank: 212407
5 MB
12 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 44
10031399.fls.doubleclick.net
4788165.fls.doubleclick.net — Cisco Umbrella Rank: 654640
10487471.fls.doubleclick.net — Cisco Umbrella Rank: 646770
ad.doubleclick.net — Cisco Umbrella Rank: 202
stats.g.doubleclick.net — Cisco Umbrella Rank: 92
cm.g.doubleclick.net — Cisco Umbrella Rank: 212
8 KB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 7782
c.6sc.co — Cisco Umbrella Rank: 11738
ipv6.6sc.co — Cisco Umbrella Rank: 15956
b.6sc.co — Cisco Umbrella Rank: 5389
17 KB
8 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 511
www.linkedin.com — Cisco Umbrella Rank: 616
px4.ads.linkedin.com — Cisco Umbrella Rank: 4745
6 KB
7 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 1266
j.clarity.ms — Cisco Umbrella Rank: 2179
c.clarity.ms — Cisco Umbrella Rank: 668
26 KB
7 google.com
adservice.google.com — Cisco Umbrella Rank: 74
www.google.com — Cisco Umbrella Rank: 7
1 KB
7 marketo.com
app-abj.marketo.com — Cisco Umbrella Rank: 667109
142 KB
6 drift.com
metrics.api.drift.com — Cisco Umbrella Rank: 5725
bootstrap.api.drift.com — Cisco Umbrella Rank: 6045
485 B
5 g2crowd.com
tracking.g2crowd.com — Cisco Umbrella Rank: 9401
3 KB
4 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 424
ib.adnxs.com — Cisco Umbrella Rank: 240
4 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 375
c.bing.com — Cisco Umbrella Rank: 232
13 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 37
20 KB
4 company-target.com
api.company-target.com — Cisco Umbrella Rank: 3542
segments.company-target.com — Cisco Umbrella Rank: 1294
3 KB
3 facebook.com
www.facebook.com — Cisco Umbrella Rank: 102
403 B
3 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 287
2 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 5483
675 B
3 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 146
200 KB
3 reactful.com
visitor.reactful.com — Cisco Umbrella Rank: 115213
106 KB
3 avct.cloud
ads.avct.cloud — Cisco Umbrella Rank: 2865
1 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 645
script.hotjar.com — Cisco Umbrella Rank: 896
vars.hotjar.com — Cisco Umbrella Rank: 989
67 KB
3 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 1493
m.addthis.com — Cisco Umbrella Rank: 1449
140 KB
3 demandbase.com
scripts.demandbase.com — Cisco Umbrella Rank: 6616
tag.demandbase.com — Cisco Umbrella Rank: 5207
82 KB
2 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 414
741 B
2 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 557
2 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 12992
421 B
2 t.co
t.co — Cisco Umbrella Rank: 495
525 B
2 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 534
555 B
2 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 13915
apt.techtarget.com — Cisco Umbrella Rank: 19549
2 KB
2 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 5275
2 KB
2 avocet.io
ads.avocet.io — Cisco Umbrella Rank: 4382
280 B
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 939
7 KB
2 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 466
1019 B
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3700
6 KB
2 geoip-js.com
geoip-js.com — Cisco Umbrella Rank: 14354
3 KB
2 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 110
32 KB
1 nr-data.net
bam-cell.nr-data.net — Cisco Umbrella Rank: 369
1 KB
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 381
14 KB
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 399
274 B
1 taboola.com
sync.taboola.com — Cisco Umbrella Rank: 977
90 B
1 yahoo.com
ads.yahoo.com — Cisco Umbrella Rank: 1156
194 B
1 pubmatic.com
image2.pubmatic.com — Cisco Umbrella Rank: 932
492 B
1 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 782
477 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 354
239 B
1 sitescout.com
pixel.sitescout.com — Cisco Umbrella Rank: 3501
267 B
1 mathtag.com
pixel.mathtag.com — Cisco Umbrella Rank: 1281
551 B
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 809
151 B
1 moatads.com
z.moatads.com — Cisco Umbrella Rank: 374
1 KB
1 adxcel-ec2.com
data.adxcel-ec2.com — Cisco Umbrella Rank: 3372
131 B
1 accountinsight.cloud
track.accountinsight.cloud — Cisco Umbrella Rank: 238024
259 B
1 gwmtracking.com
gwmtracking.com — Cisco Umbrella Rank: 16880
389 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 22404
241 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 17746
279 B
1 chip2gift.com
secure.chip2gift.com — Cisco Umbrella Rank: 496110
304 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 638
14 KB
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 598
98 B
1 mktoresp.com
309-rhv-619.mktoresp.com — Cisco Umbrella Rank: 551998
311 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 46
1 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 71
91 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 1364
38 KB
226 61
Domain Requested by
64 js.driftt.com www.proofpoint.com
js.driftt.com
23 www.proofpoint.com www.proofpoint.com
15 d.adroll.com 12 redirects s.adroll.com
www.proofpoint.com
8 b.6sc.co www.proofpoint.com
8 s.adroll.com 2 redirects www.googletagmanager.com
www.proofpoint.com
s.adroll.com
d.adroll.com
7 app-abj.marketo.com www.proofpoint.com
app-abj.marketo.com
5 tracking.g2crowd.com www.proofpoint.com
4 metrics.api.drift.com js.driftt.com
4 j.clarity.ms www.clarity.ms
j.clarity.ms
4 px.ads.linkedin.com 4 redirects
4 adservice.google.com www.proofpoint.com
4788165.fls.doubleclick.net
10031399.fls.doubleclick.net
10487471.fls.doubleclick.net
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.proofpoint.com
3 www.facebook.com www.proofpoint.com
3 x.bidswitch.net 2 redirects www.proofpoint.com
3 www.google.de www.proofpoint.com
3 www.google.com www.proofpoint.com
3 secure.adnxs.com 2 redirects j.6sc.co
3 connect.facebook.net www.proofpoint.com
connect.facebook.net
3 visitor.reactful.com www.proofpoint.com
visitor.reactful.com
3 ads.avct.cloud 1 redirects www.proofpoint.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.proofpoint.com
2 bootstrap.api.drift.com js.driftt.com
2 c.clarity.ms 1 redirects
2 eb2.3lift.com 1 redirects www.proofpoint.com
2 dsum-sec.casalemedia.com 1 redirects www.proofpoint.com
2 epsilon.6sense.com j.6sc.co
2 px4.ads.linkedin.com www.proofpoint.com
10487471.fls.doubleclick.net
2 www.linkedin.com 2 redirects
2 t.co www.proofpoint.com
2 analytics.twitter.com www.proofpoint.com
2 ad.doubleclick.net 2 redirects
2 10487471.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 4788165.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 dev.visualwebsiteoptimizer.com www.proofpoint.com
2 ads.avocet.io 2 redirects
2 snap.licdn.com www.proofpoint.com
10487471.fls.doubleclick.net
2 10031399.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 segments.company-target.com 1 redirects www.proofpoint.com
2 match.prod.bidr.io 2 redirects
2 api.company-target.com scripts.demandbase.com
js.driftt.com
2 s7.addthis.com www.proofpoint.com
s7.addthis.com
2 googleads.g.doubleclick.net www.googleadservices.com
2 scripts.demandbase.com www.proofpoint.com
tag.demandbase.com
2 munchkin.marketo.net www.proofpoint.com
munchkin.marketo.net
2 geoip-js.com www.proofpoint.com
geoip-js.com
2 www.googleadservices.com www.proofpoint.com
www.googletagmanager.com
1 bam-cell.nr-data.net js-agent.newrelic.com
1 c.bing.com 1 redirects
1 m.addthis.com s7.addthis.com
1 js-agent.newrelic.com www.proofpoint.com
1 cm.g.doubleclick.net 1 redirects
1 us-u.openx.net www.proofpoint.com
1 ib.adnxs.com www.proofpoint.com
1 sync.taboola.com www.proofpoint.com
1 ads.yahoo.com www.proofpoint.com
1 image2.pubmatic.com www.proofpoint.com
1 sync.outbrain.com www.proofpoint.com
1 pixel.rubiconproject.com www.proofpoint.com
1 tag.demandbase.com scripts.demandbase.com
1 apt.techtarget.com www.proofpoint.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 pixel.sitescout.com 10487471.fls.doubleclick.net
1 pixel.mathtag.com 4788165.fls.doubleclick.net
1 www.clarity.ms bat.bing.com
1 stats.g.doubleclick.net www.google-analytics.com
1 onetag-sys.com www.proofpoint.com
1 z.moatads.com s7.addthis.com
1 vars.hotjar.com static.hotjar.com
1 script.hotjar.com static.hotjar.com
1 data.adxcel-ec2.com www.proofpoint.com
1 track.accountinsight.cloud www.proofpoint.com
1 gwmtracking.com 1 redirects
1 attr.ml-api.io www.proofpoint.com
1 s.ml-attr.com 1 redirects
1 j.6sc.co www.proofpoint.com
1 trk.techtarget.com www.proofpoint.com
1 secure.chip2gift.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 id.rlcdn.com www.proofpoint.com
1 309-rhv-619.mktoresp.com munchkin.marketo.net
1 fonts.googleapis.com www.proofpoint.com
1 www.googletagmanager.com www.proofpoint.com
1 www.googleoptimize.com www.proofpoint.com
226 85
Subject Issuer Validity Valid
proofpoint.com
Sectigo RSA Organization Validation Secure Server CA
2022-04-25 -
2023-04-25
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
app-abj.marketo.com
Cloudflare Inc ECC CA-3
2022-05-05 -
2023-05-05
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-17 -
2022-07-16
a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2
2021-10-18 -
2022-10-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2022-02-27 -
2023-02-28
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-30 -
2022-11-30
a year crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2
2021-10-20 -
2022-09-26
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2022-02-03 -
2023-02-25
a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01
2022-03-16 -
2022-09-16
6 months crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-21 -
2022-07-26
a year crt.sh
*.hotjar.com
Amazon
2021-11-25 -
2022-12-23
a year crt.sh
*.doubleclick.net
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2022-03-01 -
2023-03-01
a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2
2020-06-19 -
2022-07-06
2 years crt.sh
*.g2crowd.com
Sectigo ECC Domain Validation Secure Server CA
2021-08-30 -
2022-09-28
a year crt.sh
*.reactful.com
Go Daddy Secure Certificate Authority - G2
2021-05-07 -
2022-06-08
a year crt.sh
drift.com
Amazon
2021-09-08 -
2022-10-07
a year crt.sh
secure.norm0care.com
Sectigo RSA Domain Validation Secure Server CA
2021-05-20 -
2022-06-19
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-03-01 -
2022-05-30
3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
s.adroll.com
Amazon
2021-08-02 -
2022-08-31
a year crt.sh
*.accountinsight.cloud
Sectigo RSA Domain Validation Secure Server CA
2020-06-09 -
2022-06-25
2 years crt.sh
adxcel-ec2.com
Amazon
2021-11-17 -
2022-12-16
a year crt.sh
www.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
www.google.de
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2021-11-27 -
2022-11-29
a year crt.sh
*.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.google.de
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2022-02-27 -
2023-02-27
a year crt.sh
pixel.mathtag.com
DigiCert SHA2 Secure Server CA
2021-06-29 -
2022-07-07
a year crt.sh
*.sitescout.com
GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
2021-12-15 -
2023-01-15
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA
2021-10-13 -
2022-11-12
a year crt.sh
*.6sense.com
Amazon
2021-06-30 -
2022-07-29
a year crt.sh
adroll.mgr.consensu.org
Amazon
2021-09-09 -
2022-10-08
a year crt.sh
a.clarity.ms
Microsoft RSA TLS CA 01
2021-07-27 -
2022-07-27
a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA H2 2021
2021-10-06 -
2022-11-07
a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1
2022-01-10 -
2023-02-10
a year crt.sh

This page contains 11 frames:

Primary Page: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Frame ID: 50DC7719463D639844B07F43BBF60943
Requests: 161 HTTP requests in this frame

Frame: https://10031399.fls.doubleclick.net/activityi;dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes;u4=undefined;u5=undefined;u6=undefined;u7=undefined;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Frame ID: 22F63BC8A2484C09252A8BE733ECE9FA
Requests: 2 HTTP requests in this frame

Frame: https://4788165.fls.doubleclick.net/activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85
Frame ID: 91EF708F7407785D586D44D15326D14E
Requests: 3 HTTP requests in this frame

Frame: https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Frame ID: 4775D42ABACB31400F5BF8C111245F4E
Requests: 5 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html
Frame ID: 96505A6AD8D3306170470BA074FD2CD5
Requests: 1 HTTP requests in this frame

Frame: https://app-abj.marketo.com/index.php/form/XDFrame
Frame ID: DA71C866597C2E7555FB99623E68E460
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 6851D4B994E4211320E8AF5064CFF963
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Frame ID: 343DC9DDC71F52D37C7FE802B1458F19
Requests: 33 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Frame ID: F23F77597DCE4489B52A4F4928D9EE44
Requests: 33 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 96619BAE324F28F0E6C9B3593A6BAB84
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: FF8B37CDF7CC932A810CB59BC98A18A7
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

University Targeted Credential Phishing Campaigns Use COVID-19, Omicron Themes | Proofpoint USFacebookTwitterLinkedInEmail

Detected technologies

Overall confidence: 75%
Detected patterns

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • addthis\.com/js/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

Overall confidence: 100%
Detected patterns
  • moatads\.com

Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

226
Requests

89 %
HTTPS

32 %
IPv6

61
Domains

85
Subdomains

71
IPs

8
Countries

6804 kB
Transfer

13520 kB
Size

83
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 56
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAHSNU7FFPEAAExKDq0dVg HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAHSNU7FFPEAAExKDq0dVg&verifyHash=1d2c5d918df34be03c5484d396fe3de932e2cfc8
Request Chain 63
  • https://10031399.fls.doubleclick.net/activityi;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes;u4=undefined;u5=undefined;u6=undefined;u7=undefined;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes HTTP 302
  • https://10031399.fls.doubleclick.net/activityi;dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes;u4=undefined;u5=undefined;u6=undefined;u7=undefined;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Request Chain 65
  • https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j HTTP 307
  • https://ads.avct.cloud/s?r=1&add=5aba5f53ab79f7f51390a95a&ty=j HTTP 307
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
Request Chain 73
  • https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j HTTP 307
  • https://ads.avct.cloud/s?r=1&add=5d1dcad3b00320110090d553&ty=j
Request Chain 74
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85 HTTP 302
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85
Request Chain 81
  • https://10487471.fls.doubleclick.net/activityi;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes HTTP 302
  • https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Request Chain 82
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=4231864771467943404
Request Chain 83
  • https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=1286129743 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CMes7ZvW8_cCFUOnmgodM3IDNw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CMes7ZvW8_cCFUOnmgodM3IDNw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Request Chain 99
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%252C3955937%26time%3D1653241954402%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252Fus%252Fblog%252Fthreat-insight%252Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&liSync=true&e_ipv6=AQKEGknklF3x2AAAAYDs5kOWc95btfOa5C5KOeiCso6hrJI3-uyoiKdbYmTl1Wf0Km_QJI0-
Request Chain 105
  • https://x.bidswitch.net/sync?dsp_id=59&user_group=2&user_id=8084c3b0-daa3-45e5-9ab3-81011560a719 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=59&user_group=2&user_id=8084c3b0-daa3-45e5-9ab3-81011560a719 HTTP 302
  • https://onetag-sys.com/match/?int_id=30&uid=0b738af6-e530-4164-8e10-a6ce2f46a5a7&gdpr=&gdpr_consent=&us_privacy=
Request Chain 125
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2782676%26time%3D1653241954670%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQJ_-KT6ukov3wAAAYDs5kOBxVUqzY2eyXMziIviuQWZ5wOO9sc0vkQnZa7biJnUlFE5FpUX
Request Chain 126
  • https://s.adroll.com/j/exp/7YJ7XZCLMRHSVCXIHB5HIT/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 127
  • https://s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js
Request Chain 142
  • https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pv=80900528386.9281&cookie=&adroll_s_ref=&keyw= HTTP 302
  • https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Request Chain 147
  • https://d.adroll.com/cm/index/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expiration=1684777955 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expiration=1684777955&C=1
Request Chain 148
  • https://d.adroll.com/cm/n/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expires=365
Request Chain 149
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Request Chain 150
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Request Chain 151
  • https://d.adroll.com/cm/r/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Request Chain 152
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Request Chain 153
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://eb2.3lift.com/xuid?mid=4714&xuid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&dongle=c85e HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Request Chain 154
  • https://d.adroll.com/cm/b/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Request Chain 155
  • https://d.adroll.com/cm/x/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://ib.adnxs.com/setuid?entity=172&code=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Request Chain 157
  • https://d.adroll.com/cm/o/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=e4e473732c9c6c9a8eb05ab2280276a0&gdpr=1&gdpr_consent=
Request Chain 158
  • https://d.adroll.com/cm/g/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT&google_nid=adroll5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5ORzcyycbJqOsFqyKAJ2oA HTTP 302
  • https://d.adroll.com/cm/g/in
Request Chain 171
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?CtsSyncId=F137EF6C06EB44A192A20A1D791C5E69&RedC=c.clarity.ms&MXFR=2A1C3FD3D73A685C20FA2E7FD33A66B0 HTTP 302
  • https://c.clarity.ms/c.gif?CtsSyncId=F137EF6C06EB44A192A20A1D791C5E69&MUID=31C77FBE7F60624B2D8D6E127EB263F3

226 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
www.proofpoint.com/us/blog/threat-insight/
67 KB
20 KB
Document
General
Full URL
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
071183eb26b32d0683f2a2536731b42fece4b9d02ec7ed06659f66e6a9762490
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Age
78123
Cache-Control
max-age=86400, public
Connection
keep-alive
Content-Encoding
gzip
Content-Length
18526
Content-Type
text/html; charset=UTF-8
Content-language
en
Date
Sun, 22 May 2022 17:52:33 GMT
ETag
"1653163829"
Expires
Sun, 22 May 2022 20:10:29 GMT
Feature-Policy
geolocation 'self'
Last-Modified
Sat, 21 May 2022 20:10:29 GMT
Link
<https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes>; rel="canonical", <https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes>; rel="shortlink" <https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes>; rel="alternate"; hreflang="en-us" <https://www.proofpoint.com/jp/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes>; rel="alternate"; hreflang="ja"
Permissions-Policy
interest-cohort=()
Referrer-Policy
origin-when-cross-origin
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Cookie,Accept-Encoding
Via
varnish
X-AH-Environment
prod
X-CDN
Imperva
X-Cache
HIT
X-Cache-Hits
5
X-Content-Type-Options
nosniff
X-Drupal-Cache
MISS
X-Drupal-Dynamic-Cache
MISS
X-Frame-Options
SAMEORIGIN
X-Generator
Drupal 9 (https://www.drupal.org)
X-Iinfo
12-122241699-122241702 NNNN CT(173 371 0) RT(1653241951740 12) q(0 0 5 1) r(7 9) U18
X-Permitted-Cross-Domain-Policies
none
X-Request-ID
v-0f6f56da-d942-11ec-8c62-6b95c70c26fe
X-UA-Compatible
IE=edge
optimize.js
www.googleoptimize.com/
96 KB
38 KB
Script
General
Full URL
https://www.googleoptimize.com/optimize.js?id=GTM-KKGL4NZ
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b9f7831c4fced894a1530c3eee8ff966cf8f9c45b635ad681e155f26811d02e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:33 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38308
x-xss-protection
0
last-modified
Sun, 22 May 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 22 May 2022 17:52:33 GMT
proofpoint.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
18 KB
18 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/proofpoint.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:32 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 09:53:20 GMT
X-CDN
Imperva
Etag
"01c16c31"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
12-122241699-0 0CNN RT(1653241951740 976) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=648652, public
Content-Length
18296
Expires
Mon, 30 May 2022 06:03:24 GMT
RobotoCondensed-Regular-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Regular-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"39ed386e"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
13-130047636-0 0CNN RT(1653241953208 8) q(0 -1 -1 0) r(0 -1)
Cache-Control
max-age=190002, public
Content-Length
21036
Expires
Tue, 24 May 2022 22:39:15 GMT
fjalla-one-v7-latin-regular.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
20 KB
20 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"3a88d25f"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
5-139358349-0 0CNN RT(1653241953205 9) q(0 -1 -1 1) r(0 -1)
Cache-Control
max-age=194251, public
Content-Length
19976
Expires
Tue, 24 May 2022 23:50:04 GMT
fjalla-one-v7-latin-regular.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
16 KB
17 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"80852160"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
5-46979365-0 0CNN RT(1653241953409 9) q(0 -1 -1 0) r(0 -1)
Cache-Control
max-age=635679, public
Content-Length
16540
Expires
Mon, 30 May 2022 02:27:12 GMT
RobotoCondensed-Bold-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Bold-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:32 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"8df65834"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
11-67257559-0 0CNN RT(1653241952609 15) q(0 -1 -1 1) r(0 -1)
Cache-Control
max-age=194251, public
Content-Length
21384
Expires
Tue, 24 May 2022 23:50:03 GMT
css_9u0o5eJuu6TGwZMprqQy-6DGTA-fv7Mh1BBQctJUE2M.css
www.proofpoint.com/sites/default/files/css/
25 KB
5 KB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_9u0o5eJuu6TGwZMprqQy-6DGTA-fv7Mh1BBQctJUE2M.css
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
f6ed28e5e26ebba4c6c19329aea432fba0c64c0f9fbfb321d4105072d2541363
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 12 Apr 2022 07:52:02 GMT
X-CDN
Imperva
Etag
"032a9b05"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/css
X-Iinfo
12-122241699-0 0CNN RT(1653241951740 997) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=190003, public
Content-Length
4376
Expires
Tue, 24 May 2022 22:39:15 GMT
css_1xwuqa3Y6zA-y5adu1B1LIWZQgX7mxNB3VGMhOI1EZQ.css
www.proofpoint.com/sites/default/files/css/
3 MB
1 MB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_1xwuqa3Y6zA-y5adu1B1LIWZQgX7mxNB3VGMhOI1EZQ.css
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d71c2ea9add8eb303ecb969dbb50752c85994205fb9b1341dd518c84e2351194
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 19 May 2022 23:07:24 GMT
X-CDN
Imperva
Etag
"726c98ab"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/css
X-Iinfo
14-60896925-0 0CNN RT(1653241953093 8) q(0 -1 -1 5) r(0 -1)
Cache-Control
max-age=971368, public
Content-Length
1519754
Expires
Thu, 02 Jun 2022 23:42:01 GMT
modernizr.min.js
www.proofpoint.com/modules/custom/pp_theme/js/
5 KB
3 KB
Script
General
Full URL
https://www.proofpoint.com/modules/custom/pp_theme/js/modernizr.min.js?v=3.11.7
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
084390577243b6986d5564d152916a37a3124305e11b2817d0c2eabc863e081b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 03 Feb 2021 00:23:01 GMT
X-CDN
Imperva
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/javascript
X-Iinfo
13-130047636-0 0CNN RT(1653241953208 33) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=194251, public
Content-Length
2533
Expires
Tue, 24 May 2022 23:50:04 GMT
modernizr-additional-tests.js
www.proofpoint.com/core/misc/
652 B
1014 B
Script
General
Full URL
https://www.proofpoint.com/core/misc/modernizr-additional-tests.js?v=3.11.7
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
9b7b5d56054f5bab6ea5dfd9472ceb900f406a8a35a3df5b17b606521a411a35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 28 Oct 2021 00:38:55 GMT
X-CDN
Imperva
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/javascript
X-Iinfo
5-46979365-0 0CNN RT(1653241953409 26) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=630280, public
Content-Length
411
Expires
Mon, 30 May 2022 00:57:13 GMT
logo-reg.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
3 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/logo-reg.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 09:53:20 GMT
X-CDN
Imperva
Etag
"13fdd2ef"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/svg+xml
X-Iinfo
5-46979365-0 0CNN RT(1653241953409 412) q(0 -1 -1 2) r(0 -1)
Cache-Control
max-age=635679, public
Content-Length
1124
Expires
Mon, 30 May 2022 02:27:12 GMT
ransomware-nav-promo.png
www.proofpoint.com/sites/default/files/nav-promo-images/
607 KB
607 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/nav-promo-images/ransomware-nav-promo.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
9732077979c7e132e29da395c2788f43f6dd4ab3020b0c0c539744be21339507
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:32 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Jan 2022 06:01:51 GMT
X-CDN
Imperva
Etag
"7124de60"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
11-67257559-0 0CNN RT(1653241952609 382) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=631441, public
Content-Length
621607
Expires
Mon, 30 May 2022 01:16:33 GMT
home.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
784 B
947 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/home.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 09:53:20 GMT
X-CDN
Imperva
Etag
"4c25cdee"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/svg+xml
X-Iinfo
12-122241699-0 0CNN RT(1653241951740 1370) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=648652, public
Content-Length
477
Expires
Mon, 30 May 2022 06:03:25 GMT
pfpt-ed-blog-banner-1.webp
www.proofpoint.com/sites/default/files/styles/image_1920_400/public/blog-banners/
32 KB
33 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/styles/image_1920_400/public/blog-banners/pfpt-ed-blog-banner-1.webp?itok=n906ktdx
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
acee3070009a7b1536809adad197b03f8bc72dd33c21310b6a3f945c6ba62142
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Via
varnish
X-Content-Type-Options
nosniff
X-CDN
Imperva
Age
1100569
X-Cache
HIT
X-Iinfo
5-139358349-139358379 NNNN CT(178 360 0) RT(1653241953205 382) q(0 0 6 -1) r(8 9) U18
X-Cache-Hits
16
Connection
keep-alive
X-AH-Environment
prod
Content-Length
33022
X-Request-ID
v-7f8134d0-cff5-11ec-9ae6-bfff372b845c
Last-Modified
Thu, 02 Dec 2021 19:47:30 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Expires
Tue, 24 May 2022 00:09:45 GMT
forms2.min.js
app-abj.marketo.com/js/forms2/js/
205 KB
68 KB
Script
General
Full URL
https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
age
530
etag
"161e11-3326e-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
70f7680328805b74-FRA
vary
Accept-Encoding
expires
Sun, 22 May 2022 21:52:34 GMT
conversion.js
www.googleadservices.com/pagead/
43 KB
17 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
895f492be4e7fcbe0f12090af4097a95d96b07157baacd9d8011c0a24e4dc947
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16860
x-xss-protection
0
server
cafe
etag
9538313714109913383
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sun, 22 May 2022 17:52:33 GMT
js_egtkFteGKbrTXssecEgF5RhaETcD3buqRO9jJCPLr60.js
www.proofpoint.com/sites/default/files/js/
165 KB
57 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_egtkFteGKbrTXssecEgF5RhaETcD3buqRO9jJCPLr60.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
7a0b6416d78629bad35ecb1e704805e5185a113703ddbbaa44ef632423cbafad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 03 May 2022 23:08:01 GMT
X-CDN
Imperva
Etag
"37bb3f14"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
X-Iinfo
14-60896925-0 0CNN RT(1653241953093 334) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=694226, public
Content-Length
57900
Expires
Mon, 30 May 2022 18:42:59 GMT
geoip2.js
geoip-js.com/js/apis/geoip2/v2.1/
3 KB
2 KB
Script
General
Full URL
https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:264a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 19 May 2022 19:53:09 GMT
server
cloudflare
age
1145
etag
W/"6286a025-da4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=43200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
70f76804aa946910-FRA
expires
Mon, 23 May 2022 05:52:34 GMT
js_Mypic69v3AM_k2tnVLPIrzNXY0af6UrC_DJGJz1MY-A.js
www.proofpoint.com/sites/default/files/js/
9 KB
3 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_Mypic69v3AM_k2tnVLPIrzNXY0af6UrC_DJGJz1MY-A.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
332a6273af6fdc033f936b6754b3c8af335763469fe94ac2fc3246273d4c63e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 19 Apr 2022 23:08:55 GMT
X-CDN
Imperva
Etag
"6e3ea0aa"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
X-Iinfo
14-60896925-0 0CNN RT(1653241953093 382) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=630280, public
Content-Length
2188
Expires
Mon, 30 May 2022 00:57:13 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Oct 2021 01:24:07 GMT
Server
AkamaiNetStorage
ETag
"461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
js_4zfo8ZSJGmjQN3Ho3vjIR7Yn8btP10KUHGLIRQynQhY.js
www.proofpoint.com/sites/default/files/js/
1 MB
434 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_4zfo8ZSJGmjQN3Ho3vjIR7Yn8btP10KUHGLIRQynQhY.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e337e8f194891a68d03771e8def8c847b627f1bb4fd742941c62c8450ca74216
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 19 May 2022 23:08:11 GMT
X-CDN
Imperva
Etag
"e148cad7"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
X-Iinfo
13-130047636-0 0CNN RT(1653241953208 387) q(0 -1 -1 2) r(0 -1)
Cache-Control
max-age=971369, public
Content-Length
444057
Expires
Thu, 02 Jun 2022 23:42:02 GMT
gtm.js
www.googletagmanager.com/
391 KB
91 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e486f52416e75722cc9aa42050581d654bba28921f67acf3830edae73f43bd71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
93119
x-xss-protection
0
last-modified
Sun, 22 May 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 22 May 2022 17:52:34 GMT
css
fonts.googleapis.com/
11 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700|Open+Sans+Condensed:300
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_1xwuqa3Y6zA-y5adu1B1LIWZQgX7mxNB3VGMhOI1EZQ.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
83558280bd3246b6d9fc7ad2201d784dbf71988c5c35a68d4a96cb4559c3789f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 22 May 2022 17:52:33 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 22 May 2022 17:52:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 22 May 2022 17:52:33 GMT
truncated
/
44 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
82 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
90 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
38 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
785386e38e422ac73429f53fc111599e675d9a02d75b3320c6c85d7df42fd232

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
73abcdba8b61ea9513c74192393cecce485ae1243f56c1cde5d61cd95650279b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fa8d00de4d9acf49fccb202f273ba09102e673a8d46bdb520d6bc9b5e740cbcd

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
204 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c8de55874475c175335f0c6fc79e975cc9325630e3641389c18ae7ae5ab9a981

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fab816e037c0f67ab424c67234af03471c66a13357d6e187ecb238a2eac62a04

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
720 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cef5e7a8bbafdc0187cc3bd50db0417a3ed578deec09d93fe306bddf30a9ba43

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
444 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4f3fc31f17996bdcd89a0b6358ef30b10a4d5b8e436dcd786082965f868f3bd8

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
606 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f156ae940f7e272f1319e3a835871f632bc4275105f4882685a3435d7ed4e3fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
685 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d1c6032b67262b3855f2ae2702f0497cf50f3caf6ce5211641f1756ee3a4332b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
460 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c0269ba28d9ec51948de3000f364e6890e8a369ab832b4deb572415845a39712

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
465 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93fa8b2f6e13b1ac02946cf42cebafaa637e07feb93b926eace76fd5128df564

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
ransomware-bg-img.png
www.proofpoint.com/sites/default/files/nav-promo-images/
14 KB
14 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/nav-promo-images/ransomware-bg-img.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6907f421de451fd5e7f962c48d39191bd7d86390df35df8b416d3ca0eb558436
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Jan 2022 06:00:50 GMT
X-CDN
Imperva
Etag
"ebf7b974"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
14-60896925-0 0CNN RT(1653241953093 393) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=190296, public
Content-Length
13846
Expires
Tue, 24 May 2022 22:44:09 GMT
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
914ae362937120d900bb5c5d95c70f3957fa2270c308925e4a72ad56446911cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
Screen%20Shot%202021-12-02%20at%2012.41.57%20PM.png
www.proofpoint.com/sites/default/files/inline-images/
897 KB
897 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screen%20Shot%202021-12-02%20at%2012.41.57%20PM.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4ae6251cfcc9e182aa356d2cb61eafd3679ae48d5c50bb6a7fed4e624120cf30
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 02 Dec 2021 19:43:16 GMT
X-CDN
Imperva
Etag
"93eefa37"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
14-60896925-60896020 2CNN RT(1653241953093 425) q(0 0 0 -1) r(0 0) U18
Cache-Control
max-age=843365, public
Content-Length
918428
Expires
Wed, 01 Jun 2022 12:08:38 GMT
Screen%20Shot%202021-12-02%20at%2012.42.30%20PM.png
www.proofpoint.com/sites/default/files/inline-images/
44 KB
44 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screen%20Shot%202021-12-02%20at%2012.42.30%20PM.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
ce2c0959ff3bc3a2b651211c4dfe4506837be5aa5065a27633aaed481f62d7fb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Via
varnish
X-Content-Type-Options
nosniff
X-CDN
Imperva
Age
1106868
X-Cache
HIT
X-Iinfo
12-122241699-122241934 2NNN RT(1653241951740 1405) q(0 0 0 -1) r(0 8) U18
X-Cache-Hits
25
Connection
keep-alive
X-AH-Environment
prod
Content-Length
44876
X-Request-ID
v-d4d8d35c-cfe6-11ec-89ea-ff56c9acb7eb
Last-Modified
Thu, 02 Dec 2021 19:45:13 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Expires
Mon, 23 May 2022 22:24:46 GMT
Screen%20Shot%202021-12-02%20at%2012.42.55%20PM_0.png
www.proofpoint.com/sites/default/files/inline-images/
1 MB
1 MB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screen%20Shot%202021-12-02%20at%2012.42.55%20PM_0.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
f0e3f836ef5ac9ca55829221dae7ca2d70050a37ce5e9dd4697d1076a1f0ea6a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Via
varnish
X-Content-Type-Options
nosniff
X-CDN
Imperva
Age
1106866
X-Cache
HIT
X-Iinfo
13-130047636-130044689 2NNN RT(1653241953208 436) q(0 0 0 -1) r(9 9) U18
X-Cache-Hits
24
Connection
keep-alive
X-AH-Environment
prod
Content-Length
1227497
X-Request-ID
v-d603723c-cfe6-11ec-bb0c-db47dd3058f2
Last-Modified
Thu, 02 Dec 2021 19:45:30 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Expires
Mon, 23 May 2022 22:24:48 GMT
Screen%20Shot%202021-12-02%20at%2012.43.28%20PM_0.png
www.proofpoint.com/sites/default/files/inline-images/
70 KB
71 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screen%20Shot%202021-12-02%20at%2012.43.28%20PM_0.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
1d4652e5179586612a28123daf3428e1aa5c1bbad11c6a136c9f2f98fa823dcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Via
varnish
X-Content-Type-Options
nosniff
X-CDN
Imperva
Age
1106245
X-Cache
HIT
X-Iinfo
5-46979365-46978162 2NNN RT(1653241953409 430) q(0 0 0 -1) r(9 9) U18
X-Cache-Hits
24
Connection
keep-alive
X-AH-Environment
prod
Content-Length
71814
X-Request-ID
v-4814ec74-cfe8-11ec-9eb7-efdfd7ec7a35
Last-Modified
Thu, 02 Dec 2021 19:44:36 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Expires
Mon, 23 May 2022 22:35:09 GMT
munchkin.js
munchkin.marketo.net/161/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Tue, 30 Aug 2022 17:52:34 GMT
MP9Jyqtx.min.js
scripts.demandbase.com/
92 KB
20 KB
Script
General
Full URL
https://scripts.demandbase.com/MP9Jyqtx.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.17.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-17-72.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8052a6fb6e64307417bdc20498d493634e5dd08188191d36dc64cd9672165e5a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id
Sn8D59q1zutrfU5eJtaPT.xE..b7EAZc
content-encoding
gzip
etag
W/"e3481cf4519ff99804e97355293f3f40"
age
920
x-cache
Hit from cloudfront
vary
Accept-Encoding
last-modified
Thu, 13 Jan 2022 01:16:33 GMT
server
AmazonS3
date
Sun, 22 May 2022 17:37:15 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
via
1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P7
x-amz-cf-id
_7DQc3EIXv61L39TYJIp-va4_WJtHpt7KFdYKhDCXapL51Ycc8tQxA==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/
2 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1653241954129&cv=9&fst=1653241954129&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&tiba=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
221cd3d962c913d9fe237b497336bc20c8a156e7898f4b2463ba24a4d07079dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1103
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cea918e6af14ac3645e0e33b30cb802820aed3e549defbd618be220c31546625

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
45 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4845e9f0ab8138835df66e6fb4d2f369f72c93c65b45cd8e545055e0382d08b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
me
geoip-js.com/geoip/v2.1/country/
756 B
1 KB
XHR
General
Full URL
https://geoip-js.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.proofpoint.com
Requested by
Host: geoip-js.com
URL: https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:264a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc00bf13873bd873249c9ca97bff43babaffe479592749671db810c34b9f5121
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
70f7680628579b1f-FRA
content-length
756
truncated
/
207 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0b6d26489191155d30162f050cf2a964afb8cf054e3f59e7f710942a9a12293

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
getForm
app-abj.marketo.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getForm?munchkinId=309-RHV-619&form=10895&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&callback=jQuery112404634172566552661_1653241954120&_=1653241954121
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48d42d796259ce76ce16275405ab9caa59e6d6867987dabe5a329b5ac15bf5c2
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
strict-transport-security
max-age=63113904
cf-ray
70f768061df55b74-FRA
cached
false
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js?_=1653241954138
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/js/js_egtkFteGKbrTXssecEgF5RhaETcD3buqRO9jJCPLr60.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Sun, 22 May 2022 17:52:34 GMT
x-host
s7.addthis.com
content-length
116325
visitWebPage
309-rhv-619.mktoresp.com/webevents/
2 B
311 B
Ping
General
Full URL
https://309-rhv-619.mktoresp.com/webevents/visitWebPage?_mchNc=1653241954261&_mchCn=&_mchId=309-RHV-619&_mchTk=_mch-proofpoint.com-1653241954260-74535&_mchHo=www.proofpoint.com&_mchPo=&_mchRu=%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
25ce7555-1d0b-4381-9b51-75515d6df250
ip.json
api.company-target.com/api/v2/
444 B
951 B
XHR
General
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&page_title=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&src=tag&key=2e81efc731d57cb3e458d08fae112991
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/MP9Jyqtx.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-20.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
c3e093146fad0e34b98a7b0f9e57fbe4ef571abfff63b3af50689b20f8718a41

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA56-P2
x-cache
Miss from cloudfront
request-id
a0057eed-4dd4-43d9-9906-a6e2508bfd21
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.proofpoint.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-F6oFAX33mEK5of_v8KC7LjDZyrBXhgT8byMQjaZYN57U6Jz7IYoZw==
expires
Sat, 21 May 2022 17:52:34 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAHSNU7FFPEAAExKDq0dVg
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAHSNU7FFPEAAExKDq0dVg&verifyHash=1d2c5d918df34be03c5484d396fe3de932e2cfc8
26 B
409 B
Image
General
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAHSNU7FFPEAAExKDq0dVg&verifyHash=1d2c5d918df34be03c5484d396fe3de932e2cfc8
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
52.222.214.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-8.fra56.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Via
1.1 eaedf92fd05c53aa96f20b6322b473e6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA56-P3
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
2b26439789476eb4
X-Amz-Cf-Id
KfmKllidRCPrDxXLS5vx9B7BBXlQmzeSzkX9hCbX0Mc24Tr7h6t15A==

Redirect headers

Date
Sun, 22 May 2022 17:52:34 GMT
Via
1.1 eaedf92fd05c53aa96f20b6322b473e6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA56-P3
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAHSNU7FFPEAAExKDq0dVg&verifyHash=1d2c5d918df34be03c5484d396fe3de932e2cfc8
Connection
keep-alive
trace-id
a42368661df26ee6
Content-Length
0
X-Amz-Cf-Id
G0U2Q17592d0xo35fLM-k06p19zp5-vro4SiSH8CY_Rdw9Gbgho8mw==
464526.gif
id.rlcdn.com/
0
98 B
Image
General
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
5606
date
Sun, 22 May 2022 16:19:08 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sun, 22 May 2022 18:19:08 GMT
conversion_async.js
www.googleadservices.com/pagead/
39 KB
15 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
0a9adccc17d9e34e3971bce91e3723f1fef884844fed6e6e10085e19745faef5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14849
x-xss-protection
0
server
cafe
etag
10272469744856839321
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sun, 22 May 2022 17:52:34 GMT
bat.js
bat.bing.com/
38 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 09 Feb 2022 23:54:49 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 668F1F4A7E5E4C38AA35259E84A6B968 Ref B: FRAEDGE1320 Ref C: 2022-05-22T17:52:34Z
etag
"806a236c101ed81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
date
Sun, 22 May 2022 17:52:33 GMT
accept-ranges
bytes
content-length
11333
uwt.js
static.ads-twitter.com/
48 KB
14 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d217d238f3f2648014fb12906dca5366954ffa6256d160726190d9e0e9c8376a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
last-modified
Wed, 18 May 2022 16:49:30 GMT
etag
"39dd6daafb219ee61305f13521c2d060+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
14051
x-served-by
cache-iad-kjyo7100074-IAD, cache-hhn11578-HHN
hotjar-1456002.js
static.hotjar.com/c/
5 KB
2 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-1456002.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.17.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-17-96.fra56.r.cloudfront.net
Software
/
Resource Hash
b0217d36bbfe3a223ab1d527de0ff899f338b848e81fd377bc02d59225d9dddb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:15 GMT
content-encoding
br
x-content-type-options
nosniff
cache-control
max-age=60
age
19
etag
W/6c2238130f62e273fecdc282921b672a
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cross-origin-resource-policy
cross-origin
x-amz-cf-pop
FRA56-P7
x-amz-cf-id
PDSnee0YvUzbG8ep71KH2pBOWJgYo3Uw0jLgwQYCFYhg7WwRg5NFJQ==
via
1.1 d34cf2ddbdf9774517330fee6a26e4b2.cloudfront.net (CloudFront)
activityi;dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog...
10031399.fls.doubleclick.net/ Frame 22F6
Redirect Chain
  • https://10031399.fls.doubleclick.net/activityi;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fb...
  • https://10031399.fls.doubleclick.net/activityi;dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3...
711 B
455 B
Document
General
Full URL
https://10031399.fls.doubleclick.net/activityi;dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes;u4=undefined;u5=undefined;u6=undefined;u7=undefined;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f6.1e100.net
Software
cafe /
Resource Hash
7466d898b42d133a1f572707e865e18a42cd25becb49bddd4807dda4121e9839
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
430
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 22 May 2022 17:52:34 GMT
expires
Sun, 22 May 2022 17:52:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 22 May 2022 17:52:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10031399.fls.doubleclick.net/activityi;dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes;u4=undefined;u5=undefined;u6=undefined;u7=undefined;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
insight.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:7::17d8:4dd1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Apr 2022 23:25:22 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=71158
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3085
s
ads.avct.cloud/
Redirect Chain
  • https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j
  • https://ads.avct.cloud/s?r=1&add=5aba5f53ab79f7f51390a95a&ty=j
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
0
336 B
Script
General
Full URL
https://ads.avct.cloud/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
54.216.196.145 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-196-145.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
content-type
application/javascript

Redirect headers

location
/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
date
Sun, 22 May 2022 17:52:34 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
100
content-type
text/html; charset=utf-8
j.php
dev.visualwebsiteoptimizer.com/
3 KB
1 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=359897&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&r=0.5579763599678651
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gams1 /
Resource Hash
b8d7a4d31c11bae41ee6b5e8a3066b55b3d8b1bb511f4b6aaf377ea39a766f5f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 22 May 2022 17:52:34 GMT
via
1.1 google
server
gams1
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type
application/javascript; charset=UTF-8
1594.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
410 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
669156b5-ebef-4423-8ebe-a80a802e048c
x-runtime
0.006738
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
70f7680748318fe6-FRA
1644.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
f63848a3-2c5d-4743-bc6a-7643c0c9599b
x-runtime
0.002951
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
70f7680748358fe6-FRA
1645.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
411 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
49e9ac60-470c-433e-97a4-b7f7e963c8ca
x-runtime
0.003244
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
70f7680748368fe6-FRA
1646.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
411 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
e24533d1-53ff-44c2-981f-1517c184b5e9
x-runtime
0.002240
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
70f7680778968fe6-FRA
1647.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
e8bf0f33-3ff7-4271-a483-06cbf64fe04d
x-runtime
0.002681
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
70f7680778988fe6-FRA
main.rtfl.js
visitor.reactful.com/dist/
273 KB
106 KB
Script
General
Full URL
https://visitor.reactful.com/dist/main.rtfl.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:810::2013 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
4d71e28edcd31a762462d68b69b58c84965188c5f19c64f9d55fe0520e33985d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 20 May 2022 03:03:50 GMT
content-encoding
gzip
server
Google Frontend
age
226124
etag
"T5buNg"
content-type
application/javascript; charset=UTF-8
x-cloud-trace-context
98d75fc983c5ceb7dbc2778bb5616547
cache-control
public,public, max-age=432000
content-length
107826
expires
Wed, 25 May 2022 03:03:50 GMT
s
ads.avct.cloud/
Redirect Chain
  • https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j
  • https://ads.avct.cloud/s?r=1&add=5d1dcad3b00320110090d553&ty=j
123 B
479 B
Script
General
Full URL
https://ads.avct.cloud/s?r=1&add=5d1dcad3b00320110090d553&ty=j
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
54.216.196.145 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-216-196-145.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
759fa142a354ae5300607b79d384f4e88d5b2df3d14e73c95c06daadae623076

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
123
content-type
application/javascript

Redirect headers

location
https://ads.avct.cloud/s?r=1&add=5d1dcad3b00320110090d553&ty=j
date
Sun, 22 May 2022 17:52:34 GMT
content-length
106
content-type
text/html; charset=utf-8
activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85
4788165.fls.doubleclick.net/ Frame 91EF
Redirect Chain
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85?
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85?
547 B
446 B
Document
General
Full URL
https://4788165.fls.doubleclick.net/activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f6.1e100.net
Software
cafe /
Resource Hash
5d6bee75e36a646121b34acd20bae27cd992624203e1d02b5f6db9c44408bc10
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
421
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 22 May 2022 17:52:34 GMT
expires
Sun, 22 May 2022 17:52:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 22 May 2022 17:52:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://4788165.fls.doubleclick.net/activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
5dfsgn7m2kst.js
js.driftt.com/include/1653242100000/
230 KB
66 KB
Script
General
Full URL
https://js.driftt.com/include/1653242100000/5dfsgn7m2kst.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
59078faaffb779d8762c4094f67d06031557b01856f955dbf4d40098b215b961
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id
UV.O1X9ICDsWUuolI7f3q8oTTz1FVsVs
content-encoding
gzip
etag
W/"bf98b2e54c6b22053574a325ade85d45"
x-amz-cf-pop
FRA56-P5
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 20 May 2022 15:58:42 GMT
server
nginx
date
Sun, 22 May 2022 17:52:34 GMT
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
i_ut3IpEJ-1Fi-_uRCeHfdJl0Yz6d8Oqz4m1OVhRZfvoysI9Do2o8w==
206034.js
secure.chip2gift.com/js/
16 B
304 B
Script
General
Full URL
https://secure.chip2gift.com/js/206034.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.11.20.152 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e9b3c1ef5622bc620a5c1d364aa9fbec2c9d6230bb5f6ab825825db09dd71f6a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 22 May 2022 17:52:34 GMT
Server
Kestrel
Content-Type
text/javascript
Expires
0
Cache-Control
no-store, must-revalidate
Connection
keep-alive
Content-Length
16
Request-Context
appId=cid-v1:abe8a76f-f1a2-4b2e-9017-0ea36ffb5c20
fbevents.js
connect.facebook.net/en_US/
99 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
acbe6770b0fc8b621a9d4f7068b241fb403fe999ea33270931ee59ec4cfdf3f1
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26310
x-xss-protection
0
pragma
public
x-fb-debug
gzhSrUOOFx6HgwMicroEtbPTNgvqimdptLv/p2lfNKKiq3oJJO0bvXR4gLNf91kb6imY28wy2m/Ly9Yf4PYbxg==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Sun, 22 May 2022 17:52:34 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
2 KB
1 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:91d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 15 Oct 2021 14:31:37 GMT
server
cloudflare
age
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
expires
Sun, 22 May 2022 17:59:14 GMT
cache-control
max-age=1200
cf-ray
70f7680888699208-FRA
cf-bgj
minify
6si.min.js
j.6sc.co/
31 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
9715
Pragma
no-cache
Last-Modified
Thu, 05 May 2022 03:45:17 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"6273484d-7b02"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Sun, 22 May 2022 17:52:34 GMT
roundtrip.js
s.adroll.com/j/
49 KB
16 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:8600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c0c801dba101fd68909389cc6e9995efbff381ae06737fe133513209a719ce5a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

X-Amz-Version-Id
.paKAlzuJXz2ehjaD.Li.bCyQ4mD6sje
Content-Encoding
gzip
Etag
W/"269380e5be330cb15e1bdf82d748cc92"
Age
2957
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
Last-Modified
Wed, 18 May 2022 18:56:53 GMT
Server
AmazonS3
Date
Sun, 22 May 2022 17:03:18 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
o_46JEAYq2wyemlDAeOj9w_VfgKk-WYpOpzrfTcecjLGzu5BepomlQ==
activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-...
10487471.fls.doubleclick.net/ Frame 4775
Redirect Chain
  • https://10487471.fls.doubleclick.net/activityi;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthre...
  • https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww...
1 KB
841 B
Document
General
Full URL
https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f6.1e100.net
Software
cafe /
Resource Hash
c68b28f30f95f2786a03a8981ff188ab21c843f792e6e7e2e87b6bffecaff45d
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
816
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 22 May 2022 17:52:34 GMT
expires
Sun, 22 May 2022 17:52:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 22 May 2022 17:52:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=4231864771467943404
0
241 B
Image
General
Full URL
https://attr.ml-api.io/?domain=proofpoint.com&pId=4231864771467943404
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
2600:9000:2490:f400:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
via
1.1 6278ee254a7d35c23aae5e936b5a56ee.cloudfront.net (CloudFront)
apigw-requestid
Sie_ijk6IAMEJrA=
x-amz-cf-pop
FRA56-P6
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
ofpNcFuwkoc50K_9uptZWEKVCx2FJ9sy02eDSzGCc9Hx3s3mJku3ug==

Redirect headers

Pragma
no-cache
Date
Sun, 22 May 2022 17:52:34 GMT
X-Proxy-Origin
185.213.155.162; 185.213.155.162; 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
cf3e7f45-21f3-48dc-9f6d-92682a7855d2
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=proofpoint.com&pId=4231864771467943404
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
src=8909468;dc_pre=CMes7ZvW8_cCFUOnmgodM3IDNw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain
  • https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=1286129743
  • https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CMes7ZvW8_cCFUOnmgodM3IDNw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CMes7ZvW8_cCFUOnmgodM3IDNw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
42 B
63 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CMes7ZvW8_cCFUOnmgodM3IDNw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
location
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CMes7ZvW8_cCFUOnmgodM3IDNw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
122
track.accountinsight.cloud/track/
2 B
259 B
Image
General
Full URL
https://track.accountinsight.cloud/track/122
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
158.255.109.19 Paris, France, ASN8218 (NEO-ASN legacy Neotelecoms, FR),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 22 May 2022 17:52:34 GMT
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
application/json; charset=utf-8
Cache-Control
no-cache
Content-Length
2
Expires
-1
/
data.adxcel-ec2.com/pixel/
43 B
131 B
Image
General
Full URL
https://data.adxcel-ec2.com/pixel/?ad_log=referer&action=content&content_id=%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pixid=93500acd-fb24-4d4c-b771-2b769752ab62
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.226.141.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-226-141-76.compute-1.amazonaws.com
Software
/
Resource Hash
693d949d8c3fdc7fd4ace7c340b5f177a9f0c5be7bafee8bc93a7d88b7523d75

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
43
Content-Type
image/gif
DE.png
www.proofpoint.com/modules/custom/pp_i18n/images/
3 KB
4 KB
Image
General
Full URL
https://www.proofpoint.com/modules/custom/pp_i18n/images/DE.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
013ebc8682bafe775a56f93904cff8456974906327dad3524e2ab2fe0c0df700
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:16 GMT
X-CDN
Imperva
Etag
"cc0c264c"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
14-60896925-0 0CNN RT(1653241953093 773) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=190492, public
Content-Length
3329
Expires
Tue, 24 May 2022 22:47:25 GMT
truncated
/
129 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca76057cd670f588df991cb00fb1f230de6cde0d7f19f21743981f12c69ab50a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
234 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
87ca6b47a6b9474223f530e7b8ea424392eb664d0dd417d61c31da449a5f5c4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
/
www.google.com/pagead/1p-user-list/950296937/
42 B
548 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1653241954129&cv=9&fst=1653238800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&tiba=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&fmt=3&is_vtc=1&random=1241788831&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/950296937/
42 B
548 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/950296937/?random=1653241954129&cv=9&fst=1653238800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&tiba=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&fmt=3&is_vtc=1&random=1241788831&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
modules.f31ba00513b7ef8234d1.js
script.hotjar.com/
243 KB
63 KB
Script
General
Full URL
https://script.hotjar.com/modules.f31ba00513b7ef8234d1.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1456002.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-74.fra56.r.cloudfront.net
Software
/
Resource Hash
5475ef880793a875564088fea38154cee107eede5a2af036f3774a3dec5e48e6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 20 May 2022 16:09:07 GMT
content-encoding
br
x-content-type-options
nosniff
age
179007
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
63712
access-control-allow-origin
*
last-modified
Fri, 20 May 2022 16:08:12 GMT
etag
"bb85a92d3aefdabfa0ed466815889fc6"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 94328d2509009edc0657f5c786a93e42.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P4
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
G_UBxm4j-8X5H1_b9ej-fKdEOeCCXNdzLN3yOSyHpyBO_TcDpmAokw==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1653241954377&cv=9&fst=1653241954377&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg5b0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&tiba=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
44a3d4b27fb8f45a3d8b610f1972d02698df05aaa1986cc3b1429a13830f0c80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1125
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
analytics.twitter.com/i/
43 B
355 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nyk4d&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=75fdaa88-3faa-4f2c-b230-ef5fe9641cdd&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time
111
date
Sun, 22 May 2022 17:52:34 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
8305817bb9815016a295949a1cb1a0c42eb340a8ebfb7fbda1336b576918abd9
content-length
43
adsct
t.co/i/
43 B
337 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nyk4d&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=75fdaa88-3faa-4f2c-b230-ef5fe9641cdd&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time
111
date
Sun, 22 May 2022 17:52:34 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
0046d006d65b10ca709fcd302a80257b7a3ba0856bf5f1f4665075a40b127806
content-length
43
adsct
analytics.twitter.com/i/
43 B
200 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=o73l9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=18531727-282b-44a3-8289-c4a48d583290&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time
112
date
Sun, 22 May 2022 17:52:34 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
8305817bb9815016a295949a1cb1a0c42eb340a8ebfb7fbda1336b576918abd9
content-length
43
adsct
t.co/i/
43 B
188 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=o73l9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=18531727-282b-44a3-8289-c4a48d583290&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time
116
date
Sun, 22 May 2022 17:52:34 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
0046d006d65b10ca709fcd302a80257b7a3ba0856bf5f1f4665075a40b127806
content-length
43
17087961.js
bat.bing.com/p/action/
219 B
475 B
Script
General
Full URL
https://bat.bing.com/p/action/17087961.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b20e2ee5eec27ca22f8b91f4357f0c52a27270a57f1ab1247bcdd4e42d4aa0a3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: DC6BF56DDAA34217809EB83870F37084 Ref B: FRAEDGE1320 Ref C: 2022-05-22T17:52:34Z
date
Sun, 22 May 2022 17:52:34 GMT
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private,max-age=60
content-length
300
0
bat.bing.com/action/
0
175 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=17087961&tm=gtm002&Ver=2&mid=cf301f94-67f6-426d-a4d0-4f9de1e71797&sid=f5b35150d9f711ecae13b9ee3d12e50f&vid=f5b3b0e0d9f711ec893f4343f08a5f7c&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19,%20Omicron%20Themes%20%7C%20Proofpoint%20US&kw=Credential%20Phishing,%20University,%20Education,%20COVID-19&p=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&r=&lt=1682&evt=pageLoad&msclkid=N&sv=1&rn=872961
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F8AD66A2C9D84507AC38DD5F77666D10 Ref B: FRAEDGE1320 Ref C: 2022-05-22T17:52:34Z
date
Sun, 22 May 2022 17:52:33 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-ca...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%252C3955937%26time%3D1653241954402%26url%3Dhttps%253A%252F%252Fwww.proofpo...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-ca...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-c...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&liSync=true&e_ipv6=AQKEGknklF3x2AAAAYDs5kOWc95btfOa5C5KOeiCso6hrJI3-uyoiKdbYmTl1Wf0Km_QJI0-
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 2E1DD9197B3F40BD99C8DE5070A5367E Ref B: FRAEDGE1210 Ref C: 2022-05-22T17:52:35Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXfnWN5uo63WKdVTWBvWA==
x-li-fabric
prod-lva1

Redirect headers

date
Sun, 22 May 2022 17:52:34 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 1AD2FED469234BC092B2FA1094B0DC97 Ref B: VIEEDGE2113 Ref C: 2022-05-22T17:52:35Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937&time=1653241954402&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&liSync=true&e_ipv6=AQKEGknklF3x2AAAAYDs5kOWc95btfOa5C5KOeiCso6hrJI3-uyoiKdbYmTl1Wf0Km_QJI0-
x-li-proto
http/2
content-length
0
x-li-uuid
AAXfnWN3tKH/vL4tyeny/g==
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=92313523&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&ul=en-us&de=UTF-8&dt=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YFBAAEABAAAAAC~&jid=1919258360&gjid=351954374&cid=1400234525.1653241954&tid=UA-2257074-1&_gid=262237260.1653241954&_r=1&gtm=2wg5b0MGR7P8X&cd19=1400234525.1653241954&z=926523784
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=92313523&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&ul=en-us&de=UTF-8&dt=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAAEABAAAAAC~&jid=&gjid=&cid=1400234525.1653241954&tid=UA-2257074-1&_gid=262237260.1653241954&gtm=2wg5b0MGR7P8X&cd19=1400234525.1653241954&cd1=(Non-Company%20Visitor)&cd2=(Non-Company%20Visitor)&cd3=(Non-Company%20Visitor)&cd4=(Non-Company%20Visitor)&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=Bot&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=Frankfurt%20am%20Main&cd11=HE&cd12=Germany&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=(Non-Company%20Visitor)&cd16=(Non-Company%20Visitor)&cd17=(Non-Company%20Visitor)&cd18=(Non-Company%20Visitor)&z=1725562760
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 02:52:10 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
54024
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
box-4924254a9ce4dc9b959b6e4a9b662d60.html
vars.hotjar.com/ Frame 9650
2 KB
1 KB
Document
General
Full URL
https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1456002.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-84.fra60.r.cloudfront.net
Software
/
Resource Hash
67f8c7fd7353ad063da1f3115924c458c494cb134f4d87de4407a132842c9bc9

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
3395008
cache-control
max-age=31536000
content-encoding
br
content-length
1044
content-type
text/html
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 13 Apr 2022 10:49:06 GMT
etag
"1635635016e428baa170305e9282c34a"
last-modified
Wed, 13 Apr 2022 10:48:29 GMT
vary
Accept-Encoding
via
1.1 02cd8164e89a1598d410a9198582d47c.cloudfront.net (CloudFront)
x-amz-cf-id
tofSUSpE1fp0B-7zh9pRR4CwW9DLKX1-ZbOmEnd1ja7ShDVwT9EHsw==
x-amz-cf-pop
FRA60-P4
x-cache
Hit from cloudfront
x-robots-tag
none
v.gif
dev.visualwebsiteoptimizer.com/
35 B
52 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=359897&d=proofpoint.com&u=D0AE54CA347B00B7826F5418295675F1B&h=2b177130be46e415170869a41d66314a&t=false&r=0.08658804126532416
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv1c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv1c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js?_=1653241954138
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-237-151.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=35104
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
/
onetag-sys.com/match/
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=59&user_group=2&user_id=8084c3b0-daa3-45e5-9ab3-81011560a719
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=59&user_group=2&user_id=8084c3b0-daa3-45e5-9ab3-81011560a719
  • https://onetag-sys.com/match/?int_id=30&uid=0b738af6-e530-4164-8e10-a6ce2f46a5a7&gdpr=&gdpr_consent=&us_privacy=
0
151 B
Image
General
Full URL
https://onetag-sys.com/match/?int_id=30&uid=0b738af6-e530-4164-8e10-a6ce2f46a5a7&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
51.75.86.98 , France, ASN16276 (OVH, FR),
Reverse DNS
ip98.ip-51-75-86.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location
//onetag-sys.com/match/?int_id=30&uid=0b738af6-e530-4164-8e10-a6ce2f46a5a7&gdpr=&gdpr_consent=&us_privacy=
Date
Sun, 22 May 2022 17:52:35 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
collect
stats.g.doubleclick.net/j/
4 B
444 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2257074-1&cid=1400234525.1653241954&jid=1919258360&gjid=351954374&_gid=262237260.1653241954&_u=YFBAAEAAAAAAAC~&z=590259851
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sun, 22 May 2022 17:52:34 GMT
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/950296937/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1653241954377&cv=9&fst=1653238800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg5b0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&tiba=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&async=1&fmt=3&is_vtc=1&random=2243894661&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/950296937/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/950296937/?random=1653241954377&cv=9&fst=1653238800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg5b0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&tiba=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&async=1&fmt=3&is_vtc=1&random=2243894661&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
17087961
www.clarity.ms/tag/uet/
2 KB
2 KB
Script
General
Full URL
https://www.clarity.ms/tag/uet/17087961
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/17087961.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:27::cafe:2154 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
21a254503a86c922c5d938d8828b1cee40c60cdd1c8e2ac1e7f72f2329705798

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
x-powered-by
ASP.NET
x-azure-ref
0Y3iKYgAAAAAz2qfMeys1R6vBjoTY4MerUk9NMzBFREdFMDYxNwA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
content-length
1544
expires
-1
/
visitor.reactful.com/config/879986/ Frame
0
0
Preflight
General
Full URL
https://visitor.reactful.com/config/879986/?page=%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&hash=&referer=&user_id=&hshkgid=f1ef9935-787d-4c1b-9ac6-d30d544127d2&cb_rtfl=_rtfl_jsonp_0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:810::2013 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
url-params-data
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Six-Sense-Data, Custom-Vars-Data, Url-Params-Data
access-control-allow-methods
GET
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache
content-length
0
content-type
text/javascript
date
Sun, 22 May 2022 17:52:34 GMT
expires
Sun, 22 May 2022 17:52:34 GMT
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
server
Google Frontend
x-cloud-trace-context
155290f8896698952b73b15d2290050a
/
visitor.reactful.com/config/879986/
0
128 B
XHR
General
Full URL
https://visitor.reactful.com/config/879986/?page=%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&hash=&referer=&user_id=&hshkgid=f1ef9935-787d-4c1b-9ac6-d30d544127d2&cb_rtfl=_rtfl_jsonp_0
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:810::2013 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
Url-Params-Data
e30=
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
server
Google Frontend
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
https://www.proofpoint.com
x-cloud-trace-context
e145b7390db660f34565ce4a4ffef704
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
Six-Sense-Data,Custom-Vars-Data,Url-Params-Data
content-length
0
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-2257074-1&cid=1400234525.1653241954&jid=1919258360&_u=YFBAAEAAAAAAAC~&z=963026461
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-2257074-1&cid=1400234525.1653241954&jid=1919258360&_u=YFBAAEAAAAAAAC~&z=963026461
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img
pixel.mathtag.com/event/ Frame 91EF
43 B
551 B
Image
General
Full URL
https://pixel.mathtag.com/event/img?mt_id=1442966&mt_adid=226348&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=&ord=1930751692
Requested by
Host: 4788165.fls.doubleclick.net
URL: https://4788165.fls.doubleclick.net/activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 4409 ba5503e master cdg-pixel-x24 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://4788165.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Server
MT3 4409 ba5503e master cdg-pixel-x24 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 22 May 2022 17:52:33 GMT
dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85
adservice.google.com/ddm/fls/z/ Frame 91EF
42 B
107 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85
Requested by
Host: 4788165.fls.doubleclick.net
URL: https://4788165.fls.doubleclick.net/activityi;dc_pre=CP3pr5vW8_cCFcAXBgAdVI4ABw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6827369249159.85?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://4788165.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=*;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversit...
adservice.google.com/ddm/fls/z/ Frame 22F6
42 B
107 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=*;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes;u4=undefined;u5=undefined;u6=undefined;u7=undefined;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Requested by
Host: 10031399.fls.doubleclick.net
URL: https://10031399.fls.doubleclick.net/activityi;dc_pre=CMe6r5vW8_cCFcQcBgAde0EEWg;src=10031399;type=sitev0;cat=psatg0;ord=2183968412243;gtm=2wg5b0;auiddc=656036162.1653241954;u2=undefined;u3=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes;u4=undefined;u5=undefined;u6=undefined;u7=undefined;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10031399.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
d7557a63ab8c88be
pixel.sitescout.com/up/ Frame 4775
43 B
267 B
Image
General
Full URL
https://pixel.sitescout.com/up/d7557a63ab8c88be?url=retargeting&cntr_revenue=&cntr_transactionId=6060673926293&u1=&u2=&u3=&u4=&u5=&cntr_url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
cache-control
max-age=0,no-cache,no-store
content-type
image/gif
content-length
43
expires
Tue, 11 Oct 1977 12:34:56 GMT
dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=*;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted...
adservice.google.com/ddm/fls/z/ Frame 4775
42 B
494 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=*;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
143852102935619
connect.facebook.net/signals/config/
305 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/143852102935619?v=2.9.60&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0a2abd304c977f8b8e4b3c9d0268fb12f7ad321d995c8245a7d737f2fdef5dda
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
e3rRWij/T+K6tEkmcP7VSF+wflKH/qQjyMdDxztD/D7UhkgEnwpqb52pBLB2sEIDA1B1OqNEvxTA/ARIzp4YwQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sun, 22 May 2022 17:52:34 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts
1653241954763
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ Frame 4775
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:7::17d8:4dd1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Apr 2022 23:25:22 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=71158
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3085
getuidj
secure.adnxs.com/
11 B
708 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 22 May 2022 17:52:34 GMT
X-Proxy-Origin
185.213.155.162; 185.213.155.162; 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
089aa134-5229-4f68-b15f-aa42e703d480
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.proofpoint.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
374 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8750785037e2d157c527efcd31e9d51e2cfdc6a236508b87526f0caa8dad8e06

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:34 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.proofpoint.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
/
ipv6.6sc.co/
20 B
257 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:296::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
3d45fdf57e5fd666b1ff640d125a0f6e7a8edfac5055af0885b29ff442d85007

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:34 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.proofpoint.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a03:1b20:6:f011::2e
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
20
expires
Sun, 22 May 2022 17:52:34 GMT
activity.gif
apt.techtarget.com/activity/
43 B
324 B
Image
General
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=1268939&version=2.1.1&ref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&r=1653241954670
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:35 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
Server
Apache/2.4.6 (CentOS)
ETag
"2b-5850384029cff"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=83
Content-Length
43
collect
px4.ads.linkedin.com/ Frame 4775
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2782676%26time%3D1653241954670%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQJ_-KT6ukov3wAAAYDs5kOBxVUqzY2eyXMziIviuQWZ5wOO9sc0vkQnZa7...
0
142 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQJ_-KT6ukov3wAAAYDs5kOBxVUqzY2eyXMziIviuQWZ5wOO9sc0vkQnZa7biJnUlFE5FpUX
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=CJ3dsZvW8_cCFQOvUQodOYIOdg;src=10487471;type=retar0;cat=retar0;ord=6060673926293;gtm=2wg5b0;auiddc=656036162.1653241954;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes?
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 18509CE48B0149218E8AC9839037521D Ref B: FRAEDGE1210 Ref C: 2022-05-22T17:52:35Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXfnWN5v2QGXH0LYi1a+w==
x-li-fabric
prod-lva1

Redirect headers

date
Sun, 22 May 2022 17:52:34 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 9F4C0791C19D4C6C94BC1557798EDB9F Ref B: VIEEDGE2113 Ref C: 2022-05-22T17:52:35Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1653241954670&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQJ_-KT6ukov3wAAAYDs5kOBxVUqzY2eyXMziIviuQWZ5wOO9sc0vkQnZa7biJnUlFE5FpUX
x-li-proto
http/2
content-length
0
x-li-uuid
AAXfnWN3gcebEAEvj5flVQ==
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/7YJ7XZCLMRHSVCXIHB5HIT/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
762 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
2600:9000:225e:8600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

X-Amz-Version-Id
Yo1foR6FJ6WFFBWqTYM2cazsDqVdFv1D
Via
1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
Etag
"5816cced8568d223aa09d889f300692b"
Age
47884
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Thu, 03 Mar 2022 22:40:46 GMT
Server
AmazonS3
Date
Sun, 22 May 2022 04:34:32 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
vnneTtsJZfBEKf3MGeoKbT56w9FuhODxWpGymSqd_QHJJR0KncZGNg==

Redirect headers

Date
Sun, 22 May 2022 05:55:24 GMT
Via
1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
Age
43030
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
iPSKVI-Lm4o8Gp9F0akGfwEiyToRj3vDY3sQlTBc_A9cfTc7rHzuww==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
733 B
Script
General
Full URL
https://s.adroll.com/j/pre/index.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
2600:9000:225e:8600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via
1.1 b1c64361268fcbad3c03abbe37eb5cfa.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
43397
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Date
Sun, 22 May 2022 05:49:19 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
mG6hVzRGItGVxCuKfmUgmxvhHwGrIStnl6YDxCa2aMUn9zHfTwBm5g==

Redirect headers

Date
Sun, 22 May 2022 07:02:05 GMT
Via
1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
Age
39030
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
p8jAWhIkGXHOz_fuBlV9sG8CxqHf_XHQWLTWF-0pd33ve26IzLDOKQ==
index.js
s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/
0
786 B
Script
General
Full URL
https://s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:8600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

X-Amz-Version-Id
MTHHZshocGLTzUOvDtipHZ0DwbO0qvow
Via
1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
2524
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Sat, 21 May 2022 11:59:54 GMT
Server
AmazonS3
Date
Sun, 22 May 2022 17:10:32 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
Bp0PVSwiF_pL7rVeilh0WkXamNWiUKZDH8VQBIzTKWIG3ge4GnW5BQ==
details
epsilon.6sense.com/v3/company/
431 B
421 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.121.14.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-121-14-2.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
43b21a37ead752a35feeeb473aecb119bc2b63800594adc825bcb903b81f23da

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
Authorization
Token cf897ce61a58c53c1861f742ebebc2622f6b0fcf
EpsilonCookie
cbd5ce17ad49000062788a628602000008fa3800

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.proofpoint.com
access-control-allow-credentials
true
content-length
234
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.121.14.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-121-14-2.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,epsiloncookie
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,epsiloncookie
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.proofpoint.com
access-control-max-age
1800
date
Sun, 22 May 2022 17:52:34 GMT
server
nginx
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A34%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:35 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3A6%3Af011%3A%3A2e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:35 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
forms2.css
app-abj.marketo.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1203
vary
Accept-Encoding
content-length
2623
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
etag
"a2881-3437-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
70f768092b7e5b74-FRA
expires
Sun, 22 May 2022 21:52:34 GMT
forms2-theme-plain.css
app-abj.marketo.com/js/forms2/css/
828 B
348 B
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
529
vary
Accept-Encoding
content-length
246
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
etag
"a287f-33c-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
70f768092b815b74-FRA
expires
Sun, 22 May 2022 21:52:34 GMT
getKnownLead
app-abj.marketo.com/index.php/form/
49 B
274 B
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getKnownLead?form=10895&lpId=&munchkinId=309-RHV-619&filledFields=true&_mkt_trk=id%3A309-RHV-619%26token%3A_mch-proofpoint.com-1653241954260-74535&callback=jQuery112404634172566552661_1653241954120&_=1653241954122
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26253bc4b0f3d7676d47355ab83b5d500d1c61bda91082a8384fd07e6de5cd52
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
application/javascript; charset=utf-8
cf-ray
70f768092b825b74-FRA
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=92313523&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&ul=en-us&de=UTF-8&dt=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=1400234525.1653241954&tid=UA-2257074-1&_gid=262237260.1653241954&gtm=2wg5b0MGR7P8X&cd19=1400234525.1653241954&cd2=&cd3=&cd5=&cd6=&cd7=Bot&cd8=&cd10=&cd11=&cd12=Sweden&cd17=&z=104079774
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 02:52:10 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
54024
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
7YJ7XZCLMRHSVCXIHB5HIT
d.adroll.com/consent/check/
448 B
916 B
Script
General
Full URL
https://d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT?arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&_s=eb67de1c960fdb775a1b0550f4e788f4&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.220.64.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-220-64-232.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
41dff0bd88ed8c2db1d7cd37dc0d2f42e06e5003910603af32ae7fd4c1ac09b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-type
application/javascript
content-length
448
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
/
www.facebook.com/tr/
44 B
297 B
Image
General
Full URL
https://www.facebook.com/tr/?id=143852102935619&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&rl=&if=false&ts=1653241954802&sw=1600&sh=1200&v=2.9.60&r=stable&ec=0&o=30&fbp=fb.1.1653241954800.1364816593&it=1653241954657&coo=false&rqm=GET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Sun, 22 May 2022 17:52:35 GMT
c23cec8d-158e-46a5-b24a-674a095070d5
https://www.proofpoint.com/
0
0
Script
General
Full URL
blob:https://www.proofpoint.com/c23cec8d-158e-46a5-b24a-674a095070d5
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Length
0
Content-Type
text/javascript
XDFrame
app-abj.marketo.com/index.php/form/ Frame DA71
2 KB
862 B
Document
General
Full URL
https://app-abj.marketo.com/index.php/form/XDFrame
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0e6c1c112eda28bd4787e19ce4920424990b564c0fb3b828ec605d91ba4813e
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
70f7680befb15b74-FRA
content-encoding
gzip
content-length
650
content-type
text/html; charset=utf-8
date
Sun, 22 May 2022 17:52:35 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
strict-transport-security
max-age=63113904
vary
Accept-Encoding
x-content-type-options
nosniff
forms_f79029b2cb.min.js
tag.demandbase.com/shared/
177 KB
57 KB
Script
General
Full URL
https://tag.demandbase.com/shared/forms_f79029b2cb.min.js
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/MP9Jyqtx.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.17.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-17-72.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
69a12e6a2c6dff14902de0fec7a22b138a389be30d22265fa1f3c629373c295e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id
ZdfV2hyb4.f3iYT1bTpwGYnAcDBeMBIJ
content-encoding
gzip
last-modified
Mon, 07 Dec 2020 19:53:05 GMT
server
AmazonS3
age
22130
etag
W/"297f27393505134e72a57f78a067e26d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
date
Sun, 22 May 2022 11:43:46 GMT
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P7
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-amz-cf-id
04okPFACEltPkErqKb3d52H0HrWWstgp72mWhqcFGAK3RoFLCVbj-Q==
T47Y2VPPABDUBJXFROMZZM.js
s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/
Redirect Chain
  • https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insig...
  • https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
5 KB
2 KB
Script
General
Full URL
https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
2600:9000:225e:8600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1dd045da6e00e9d34ddd4f5a29d9377a6cc0b6ea617bbb21f18cd13a3f806a16

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

X-Amz-Version-Id
tb2sBEWeX0oJ_ZoQmEIgqRqeFY7lTh57
Content-Encoding
gzip
Etag
W/"ef070904b23b2bd68644b6254e944d4b"
Age
2633
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 b1c64361268fcbad3c03abbe37eb5cfa.cloudfront.net (CloudFront)
Last-Modified
Thu, 12 May 2022 15:24:27 GMT
Server
AmazonS3
Date
Sun, 22 May 2022 17:08:43 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
ILuzypEgKpjrwvubjtf6-PEqc5Z_hAZKhjrC315Y-WDSvVc6LDJ2wQ==

Redirect headers

date
Sun, 22 May 2022 17:52:35 GMT
x-segment-display-name
Visitors to Unsegmented Pages
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
x-rule-type
p
content-length
0
pragma
no-cache
x-conversion-value
0.00
server
nginx/1.20.0
x-rule
*
x-segment-eid
T47Y2VPPABDUBJXFROMZZM
location
https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
cache-control
no-store, no-cache, must-revalidate
x-pixel-eid
YV5KYXXEJZATZCT37YRTMK
x-segment-name
*
x-advertisable-eid
7YJ7XZCLMRHSVCXIHB5HIT
x-conversion-currency
clarity.js
j.clarity.ms/s/0.6.34/
53 KB
23 KB
Script
General
Full URL
https://j.clarity.ms/s/0.6.34/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/17087961
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.85.30.134 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
content-encoding
br
etag
"1d86ac05e8dcb54"
last-modified
Wed, 18 May 2022 14:05:46 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
stylesheet_f79029b2cb.v2.css
scripts.demandbase.com/shared/
27 KB
4 KB
Stylesheet
General
Full URL
https://scripts.demandbase.com/shared/stylesheet_f79029b2cb.v2.css
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/shared/forms_f79029b2cb.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.17.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-17-72.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fa176af3695a7e918096d7d71a501167980482180f48dc0e4515855901b42969
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 02:48:48 GMT
content-encoding
gzip
last-modified
Mon, 07 Dec 2020 19:53:05 GMT
server
AmazonS3
age
54228
etag
W/"178916ae2031afd4e0b75797aa965718"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
csDn.NNS9VGplSm_6jcpT8H1jYl4C4Qr
via
1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P7
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css; charset=UTF-8
x-amz-cf-id
WDsEyWsHqBIVaQkzhNOiCUKac4WtmIUVT1yPSeERR6L-VNpBanOQcA==
sendrolling.js
s.adroll.com/j/
9 KB
3 KB
Script
General
Full URL
https://s.adroll.com/j/sendrolling.js
Requested by
Host: d.adroll.com
URL: https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pv=80900528386.9281&cookie=&adroll_s_ref=&keyw=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:8600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8b4fb78c5e5599a29f86d20a29d4f69e3ed0654547b1a595cf038ee0553b58d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

X-Amz-Version-Id
ZF339xBDqZ1K9SKXIggpL0GW25oAXt0X
Content-Encoding
gzip
Etag
W/"156295addf985cb637d7863ee802fd77"
Age
135
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 b1c64361268fcbad3c03abbe37eb5cfa.cloudfront.net (CloudFront)
Last-Modified
Mon, 11 Apr 2022 15:24:31 GMT
Server
AmazonS3
Date
Sun, 22 May 2022 17:50:21 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
oFVrG0y1pXWbUh7a6RWl8O_S0A4W9hp9D-h09sllLEk1HZgn-6qWxw==
389545881899618
connect.facebook.net/signals/config/
305 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/389545881899618?v=2.9.60&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
12f912f4fa15bfc798701449ffa17fb4ee53df0a64211ce962ee58864585d449
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
MHJaCgRyngESqrMbr4YIpVu4AKb3j38uJHGM8wt+SuzXef/BfSnXxysI0D1Oyfo05vNxzOCiopW5LDkgQ/7GhA==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sun, 22 May 2022 17:52:35 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts
1653241955358
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
rum
dsum-sec.casalemedia.com/
Redirect Chain
  • https://d.adroll.com/cm/index/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phi...
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expiration=1684777955
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expiration=1684777955&C=1
43 B
1 KB
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expiration=1684777955&C=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-236-247.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 22 May 2022 17:52:35 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 22 May 2022 17:52:35 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 22 May 2022 17:52:35 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expiration=1684777955&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
333
Expires
Sun, 22 May 2022 17:52:35 GMT
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://d.adroll.com/cm/n/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishin...
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expires=365
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expires=365
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type
image/gif

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&expires=365
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
124
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cookie-sync
sync.outbrain.com/
Redirect Chain
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-...
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
0
477 B
Image
General
Full URL
https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
64.202.112.191 Harrodsburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:35 GMT
Cache-Control
no-cache
X-TraceId
cc738d76a152eb7419754068fbf2212a
Content-Length
0

Redirect headers

location
https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
100
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pug
image2.pubmatic.com/AdServer/
Redirect Chain
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXy...
42 B
492 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, private
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
212
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
v1
ads.yahoo.com/cms/
Redirect Chain
  • https://d.adroll.com/cm/r/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishin...
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
0
194 B
Image
General
Full URL
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

location
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
165
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-p...
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
0
90 B
Image
General
Full URL
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
13656

Redirect headers

location
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
111
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
xuid
eb2.3lift.com/
Redirect Chain
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credentia...
  • https://eb2.3lift.com/xuid?mid=4714&xuid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&dongle=c85e
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
37 B
354 B
Image
General
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
/xuid?ld=1&mid=4714&xuid=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
x.bidswitch.net/
Redirect Chain
  • https://d.adroll.com/cm/b/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishin...
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
43 B
220 B
Image
General
Full URL
https://x.bidswitch.net/sync?dsp_id=44&user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
3.124.34.143 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-34-143.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:35 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

location
https://x.bidswitch.net/sync?dsp_id=44&user_id=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
96
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
setuid
ib.adnxs.com/
Redirect Chain
  • https://d.adroll.com/cm/x/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishin...
  • https://ib.adnxs.com/setuid?entity=172&code=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/setuid?entity=172&code=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Server
37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 22 May 2022 17:52:35 GMT
X-Proxy-Origin
185.213.155.162; 185.213.155.162; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
6cc8aed6-56c1-42f1-8438-0ec897c967c1
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

location
https://ib.adnxs.com/setuid?entity=172&code=ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
93
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
out
d.adroll.com/cm/l/
42 B
180 B
Image
General
Full URL
https://d.adroll.com/cm/l/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.220.64.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-220-64-232.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.20.0
content-length
42
vary
Cookie
content-type
image/gif
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://d.adroll.com/cm/o/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishin...
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=e4e473732c9c6c9a8eb05ab2280276a0&gdpr=1&gdpr_consent=
43 B
274 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537103138&val=e4e473732c9c6c9a8eb05ab2280276a0&gdpr=1&gdpr_consent=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.1.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
via
1.1 google
server
OXGW/18.1.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537103138&val=e4e473732c9c6c9a8eb05ab2280276a0&gdpr=1&gdpr_consent=
pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
108
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
in
d.adroll.com/cm/g/
Redirect Chain
  • https://d.adroll.com/cm/g/out?adroll_fpc=c20fe70d16773d7cfdd95f1be3901e1c-1653241955197&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishin...
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5ORzcyycbJqOsFqyKAJ2oA
  • https://d.adroll.com/cm/g/in
42 B
536 B
Image
General
Full URL
https://d.adroll.com/cm/g/in
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Server
54.220.64.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-220-64-232.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
server
nginx/1.20.0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42
x-result
g.-1.-1.-1

Redirect headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://d.adroll.com/cm/g/in
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
225
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
forms2.min.js
app-abj.marketo.com/js/forms2/js/ Frame DA71
205 KB
68 KB
Script
General
Full URL
https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app-abj.marketo.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
age
531
etag
"161e11-3326e-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
70f7680cd9495b74-FRA
vary
Accept-Encoding
expires
Sun, 22 May 2022 21:52:35 GMT
/
www.facebook.com/tr/
44 B
88 B
Image
General
Full URL
https://www.facebook.com/tr/?id=389545881899618&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&rl=&if=false&ts=1653241955376&cd[segment_eid]=T47Y2VPPABDUBJXFROMZZM&sw=1600&sh=1200&v=2.9.60&r=stable&ec=0&o=29&fbp=fb.1.1653241954800.1364816593&it=1653241954657&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:35 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority
u=3,i
expires
Sun, 22 May 2022 17:52:35 GMT
/
www.facebook.com/tr/ Frame 6851
0
18 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.proofpoint.com
Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.proofpoint.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Sun, 22 May 2022 17:52:35 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A34%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:35 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
j.clarity.ms/
0
72 B
XHR
General
Full URL
https://j.clarity.ms/collect
Requested by
Host: j.clarity.ms
URL: https://j.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.85.30.134 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Sun, 22 May 2022 17:52:35 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
collect
j.clarity.ms/
0
25 B
XHR
General
Full URL
https://j.clarity.ms/collect
Requested by
Host: j.clarity.ms
URL: https://j.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.85.30.134 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Sun, 22 May 2022 17:52:35 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
core
js.driftt.com/ Frame 343D
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1653242100000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
f72897665fa11d91ed461bb1bcfb0426fa50c41e239aeca001789f5739daa238
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Sun, 22 May 2022 17:52:36 GMT
etag
W/"87e64ab814e752757811f2724a367295"
last-modified
Fri, 20 May 2022 15:58:21 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
x-amz-cf-id
gDjQti-UrNdj65KMWYZR7IzPycuyavtPpYrjtga-EiWb9wt3PxyPBQ==
x-amz-cf-pop
FRA56-P5
x-amz-server-side-encryption
AES256
x-amz-version-id
hBfzt5jQeiARIMsIuglCB2oO8DI4IwXi
x-cache
Hit from cloudfront
chat
js.driftt.com/core/ Frame F23F
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1653242100000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
f72897665fa11d91ed461bb1bcfb0426fa50c41e239aeca001789f5739daa238
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Sun, 22 May 2022 17:52:36 GMT
etag
W/"87e64ab814e752757811f2724a367295"
last-modified
Fri, 20 May 2022 15:58:21 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
x-amz-cf-id
VA4WiE7a_y-i_vSlx5DNfk0jW6l8IK4n4DbQyU7dZ2l8YK5pm4deIA==
x-amz-cf-pop
FRA56-P5
x-amz-server-side-encryption
AES256
x-amz-version-id
hBfzt5jQeiARIMsIuglCB2oO8DI4IwXi
x-cache
Hit from cloudfront
nr-1216.min.js
js-agent.newrelic.com/
38 KB
14 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-1216.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id
mHHzJIqOizHibcYt0xqAszRr0gQRiNYy
content-encoding
gzip
etag
"9f533d8cd24b2c5e3b4dc886ecbd43e8"
x-amz-request-id
702BXDH9DS50TBSA
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
14391
x-amz-id-2
5vd9vstz3V3z74kfjj1dCPZWEqafZIkasHjA0BdDCJvZTnwH4UnkRjWckumVI0cOdusYAlzF0pM=
x-served-by
cache-hhn4030-HHN
last-modified
Thu, 14 Apr 2022 16:45:57 GMT
server
AmazonS3
x-timer
S1653241956.093356,VS0,VE0
date
Sun, 22 May 2022 17:52:36 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
15147
300lo.json
m.addthis.com/live/red_lojson/
89 B
249 B
Script
General
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=628a7862bc5e3a97&bkl=0&bl=1&pdt=1681&sid=628a7862bc5e3a97&pub=&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.proofpoint.com&fp=us%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=Credential%20Phishing%2CUniversity%2CEducation%2CCOVID-19&colc=1653241956082&jsl=8193&uvs=628a786264fa6b6f000&skipb=1&callback=addthis.cbs.jsonp__28578162712575140
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js?_=1653241954138
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b91353c2afda91b4cc980d1b673530b4a7dab4f4f4c5d0b6c27b69fb8da44273

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:36 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
89
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 9661
0
0

sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame FF8B
71 KB
26 KB
Document
General
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js?_=1653241954138
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=86313600
content-encoding
gzip
content-length
26421
content-type
text/html
date
Sun, 22 May 2022 17:52:36 GMT
etag
W/"5f971164-11adc"
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
p3p
CP="NON ADM OUR DEV IND COM STA"
server
nginx/1.15.8
strict-transport-security
max-age=15724800; includeSubDomains
timing-allow-origin
*
vary
Accept-Encoding
x-host
s7.addthis.com
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?CtsSyncId=F137EF6C06EB44A192A20A1D791C5E69&RedC=c.clarity.ms&MXFR=2A1C3FD3D73A685C20FA2E7FD33A66B0
  • https://c.clarity.ms/c.gif?CtsSyncId=F137EF6C06EB44A192A20A1D791C5E69&MUID=31C77FBE7F60624B2D8D6E127EB263F3
42 B
392 B
Image
General
Full URL
https://c.clarity.ms/c.gif?CtsSyncId=F137EF6C06EB44A192A20A1D791C5E69&MUID=31C77FBE7F60624B2D8D6E127EB263F3
Protocol
H2
Server
52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:36 GMT
last-modified
Fri, 18 Mar 2022 19:39:54 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"8120eaf0ff3ad81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Sun, 22 May 2022 17:52:35 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: CEB401457BE84EC0A17DE3071B41B23F Ref B: FRAEDGE1320 Ref C: 2022-05-22T17:52:36Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?CtsSyncId=F137EF6C06EB44A192A20A1D791C5E69&MUID=31C77FBE7F60624B2D8D6E127EB263F3
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
0ae22ad83e
bam-cell.nr-data.net/1/
49 B
1 KB
Script
General
Full URL
https://bam-cell.nr-data.net/1/0ae22ad83e?a=573869349&v=1216.487a282&to=bgQBYERQXBBWVBFbDldOIldCWF0NGHMXRxFYDT9aWVVXP3RYC0YTVg0PUURtfAxTUjNbBE4iDFpCQ10PW1IXH19PCAZD&rst=3543&ck=1&ref=https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&ap=624&be=1206&fe=3494&dc=1658&perf=%7B%22timing%22:%7B%22of%22:1653241952574,%22n%22:0,%22f%22:0,%22dn%22:0,%22dne%22:31,%22c%22:31,%22s%22:37,%22ce%22:46,%22rq%22:46,%22rp%22:948,%22rpe%22:955,%22dl%22:960,%22di%22:1658,%22ds%22:1658,%22de%22:1682,%22dc%22:3466,%22l%22:3493,%22le%22:3515%7D,%22navigation%22:%7B%7D%7D&fp=1403&fcp=1901&at=QkMWFgxKT08VVkcIGkQc&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1216.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:36 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Cross-Origin-Resource-Policy
cross-origin
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Connection
keep-alive
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wq0OcPTqtTvdpwn5qxNAZne%2BjGrGk0wFH0MmG%2FtvKd3mMpJ94vcY79yw9b%2B40J0iCF%2F9cCIMAPJZzvYAekqejgOXDMgOWd9kSMWTuu9K1r%2FGLFHAkJPtconxSdAS%2FIsvIAuSn9iy"}],"group":"cf-nel","max_age":604800}
Content-Type
text/javascript
Access-Control-Allow-Origin
*
access-control-allow-credentials
true
CF-Ray
70f76811ff028fc8-FRA
runtime~main.17bd9f4a.js
js.driftt.com/core/assets/js/ Frame 343D
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
55c6067b4d7ebfef0949105fd3947512f88922efe2a18f8423b021b5d6cc120f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 20 May 2022 15:58:21 GMT
content-encoding
gzip
age
179655
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 20 May 2022 15:32:36 GMT
server
nginx
etag
W/"d627a17955a521f542d51e9f006d567f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
HHWWd3wdR5lWRU0LmSDDHF0MbK6.uehk
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
sbPLowHdhqs8z2D_lbvo3t6f61jaLaKQ2nGg1t2fiq3ns-XqHe2IXw==
5.b4ccdd57.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
58 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/5.b4ccdd57.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:05 GMT
content-encoding
gzip
age
4787311
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:37 GMT
server
nginx
etag
W/"bf2b7dc96b40587d388df8918a276f1d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
gPWEytTOik4qOc_CalZVIUqNneMaJOup
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
B2v3SW6FUOYVVvhPkqJelOVNh8uxgqNprzIuV5avL3EDvaO__LVP1g==
main~493df0b3.e4b52ccf.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.e4b52ccf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
d862322f40f2d63eca24e2e6188d0a164bf431db27369bedebb31c357985f7f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:08 GMT
server
nginx
etag
W/"69362f73a04491df20548a6acabbd746"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2zxmXJCeUVcrAdxDs6oDiJa7iJ7fH8N.
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
KQjYQiCbfO0jJxX3wVYjDuPrdfLzeRaAzmfprskOYe8CiIT5BukbgA==
44.36014458.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/44.36014458.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
73aefc68f91234a52983d4c0a8037888d05af3f62d6e9b97993ebc4cb5791cbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 10 Apr 2022 22:49:34 GMT
content-encoding
gzip
age
3610982
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 08 Apr 2022 15:57:16 GMT
server
nginx
etag
W/"f3141bda9ba639e2d01218d7e7cd8311"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
B5nQx62kfGixFNs6i7158XuE6Q0q4UA8
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
B5JIWZ9AyKZxm65Zij9dgoCwRWGHLjkPRM51El-9SODgRpSmtqgwHg==
19.c2c4ec2d.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.c2c4ec2d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
24caab840126c1089470704d65dcbb1dadc8ace5328b28de54b297e482ac3c3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 22:35:26 GMT
content-encoding
gzip
age
2315830
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 25 Apr 2022 20:45:35 GMT
server
nginx
etag
W/"ca27a219f5babe50f6eb7c982fa61d4a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
GP6AWJ95Oeeek71gysVMlYSExP067DB1
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pSFydmy3IE8O7bUZZBRXXA9d1Xm2kq0i8AGGmwBuTHHYeDrIm1aA3w==
37.dc112dfd.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/37.dc112dfd.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 05 Apr 2022 02:06:54 GMT
content-encoding
gzip
age
4117542
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:20 GMT
server
nginx
etag
W/"391f6f28819c5b154653979d5154c888"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
vKbfuupFATroRl3aNDGfs3ThogQLzb9z
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
G_cMUC0dPOIdF7CaLAQ2mWOofJVuKQZYC-k8oWu7qjS4Z7dMDbZH-w==
16.10d76686.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.10d76686.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 04 Jan 2022 15:53:42 GMT
content-encoding
gzip
age
11930334
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 04 Jan 2022 15:08:17 GMT
server
nginx
etag
W/"c16e855d0a26bf91ae3cc32cdbfa3ad6"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
mzB2ul0u_48ftIGEd6phwcoTfextzATL
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
9cuM2HKphIk2AnQWtFJmfmxEyLCdGjVbfRhXYpEgnwaVLQeFbHmxZw==
21.8ac5d777.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
72 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.8ac5d777.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 05 Apr 2022 02:06:54 GMT
content-encoding
gzip
age
4117542
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:19 GMT
server
nginx
etag
W/"c39414a669b98ba4a25856ccdc1c1c1b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Ilpiiyhlyh6s3iuNf.37uZlW5ugPpx91
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
sdzWdfmO4yrfrT1A6sjeJYvddIIcd4o62kEGcphEvxDENYtz4DXQcA==
34.801d3c89.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
16 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/34.801d3c89.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:36 GMT
server
nginx
etag
W/"fa218b0849860dbc5ceda153316c9c38"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
lKdT83hFk6oc4yzwjkCPtmRufEzn_1y9
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pqIbJG0PVM0hzaV9ZnfVF-Mv3ucatNT4MWGQElkKT0Q0CqmEAcsr3w==
23.16e779ff.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.16e779ff.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
882447805fc1c7805ad98684a4698c4b3ae5e8932261c609f7cdd0834275d72c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 13:25:10 GMT
content-encoding
gzip
age
3212846
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 14 Apr 2022 14:51:25 GMT
server
nginx
etag
W/"ef4446c0fdb98929baf632c38e8cd226"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
6QFFV552d_qyZ9pcsgZNY8fkBisjodK4
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3l5rVBdGwSS1EbUPezjvEPYHEWrzMsNILZstRGowZKl8Q4Sq4y2ugg==
11.8d62d6c4.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.8d62d6c4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:35 GMT
server
nginx
etag
W/"8199a8634768214fc6204b18351f842d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
IO06C9jhzvCi9VImuydD04sGtIPTZ6T.
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
riWyCP81hRDOEoi3v_N0e1NC3s5HiaiJgfYf_GoYRTGzj6vB66MMNQ==
10.b73b895d.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.b73b895d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
494a73882e211c16a50493069a632e339e15d32fd8519f22766a0a0e235f7d01
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 12 May 2022 17:56:16 GMT
content-encoding
gzip
age
863780
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 12 May 2022 17:28:59 GMT
server
nginx
etag
W/"5c6cb58ced9f55b696578307366a68ac"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
42s0ZS8AeOMe_PH.Rce3w4xkhbhmKcpn
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
SGSAiVrsHhyveNzrZH6EHLYO6sMTR8g3gMBSWjTcwKxMozpKzgdYwg==
14.2a01ddd6.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.2a01ddd6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 04 Jan 2022 15:53:41 GMT
content-encoding
gzip
age
11930335
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 04 Jan 2022 15:08:17 GMT
server
nginx
etag
W/"6f457384188c98017d8d27281f3df6ad"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
KpoEpDmO7G9TLWLfSTzA1dytLAyREIfM
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2k_DlE29EOKP8J0IlR0Lbn5S6Af8gzuc9Ob2KOc4ejm0FXNzQeowdQ==
42.85bf5aa5.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.85bf5aa5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
b70c36674f1298febe27d175904d872013535e9b0e20136b5dd86bb51c2729e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 10 Apr 2022 22:49:34 GMT
content-encoding
gzip
age
3610982
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 08 Apr 2022 15:57:16 GMT
server
nginx
etag
W/"8c7c0bf11a78a30db0b2b7f63660c3d1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
mxBFWZx1wZ1xN.1nj_wZKtLvuDeu4lk_
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
O0qWkNxnMFNABhE5nlpS3BR9zpQmmDCsV4VaYrmJY_knhC88DtmuVA==
35.0810b4b3.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.0810b4b3.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 22:12:26 GMT
content-encoding
gzip
age
4131610
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:20 GMT
server
nginx
etag
W/"4a61646db5420cc31cb60b9287d9f544"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
0Zui0kJ5MSbHpImulx8UM9hDRN0gPHQk
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
163E3oII3GvW9GeKWmZM9cAy-tVvEi2OozFB6HyWjZWi2bAKSDUB0g==
26.81342ce1.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.81342ce1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
652cfd16c30cffe323376752f023f8f9738af74b807bda8e929ecba78d9ed19d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 13:25:10 GMT
content-encoding
gzip
age
3212846
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 14 Apr 2022 14:51:25 GMT
server
nginx
etag
W/"fb3937eee6b2751c3fc0c91dce12c2ca"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Kb9jiolYAspdT0T2FEuoVylYgxdOCuEs
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
JeH_JrL5akKo4Y7-8fX39Wsj9kIAco-rHMpKWAeqqEaSZF_v_mFkqQ==
18.3ca2a055.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.3ca2a055.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
5dad1cd9bd8a255538159566f3a5621e4dbe821ab334c23acd443810b950bb88
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:06 GMT
server
nginx
etag
W/"4cfccba39f0ab35f70bc772f1d0eb4c2"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
AOsH7T1Yo.NhD3RTtLUBAEdTLdlQFzkv
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
E31MAH1NdjMQVLUCJaAgOjHBi2m4972b_mYv1lOobAwMnzhuHJf-Qw==
8.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame 343D
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/8.5b0bb1c3.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
02840352581026aad3291a8357da6876c93b0e6d8aec9532bbc1a42f82bca1c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:33 GMT
server
nginx
etag
W/"e3c43c4a3d2f4cee45cccdb6e438af66"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8ZsEKgx7NBbOWsOo7y482B7LIK3_mShC
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-bPPUFxZKgnbm2T5aC83glrVeCO41koNnNV5RHOagFBU1EvbCWdK6g==
8.8e3b3a7f.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
71 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.8e3b3a7f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
ca7362fcc0e9111db58886105f1f991c5090eeed7b08e2892612704f3be1c4c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:07 GMT
server
nginx
etag
W/"45dc590878796b9b88476ebcc9b9d3b8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
OmX6mBr67Bd69RMnY4ee.6RCkJcoZI8v
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
8NR5uJHMzwMfrWkBH39c4BM0yZci65LSwiiCT3z--rGkyDCJFlpz5Q==
15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 343D
24 B
667 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 04 Jan 2022 15:53:41 GMT
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
age
11930335
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Tue, 04 Jan 2022 15:08:15 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
bzo2zbrJexGHlTPaLulG8N5yfdXT7FR0
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
yaSA3nj0LUmAFZFp6FaYrR9OwmY1bp2f9Qgzvp3IqhgkV4PsUhjuig==
15.b05dc660.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
78 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.b05dc660.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
6da17efdd329929b537064639b37368da51734209944097eaebd4ab6e2acd3ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:05 GMT
server
nginx
etag
W/"a58ddbf68856497e42c8020066e03bae"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
LENnMtbvszMAu5pFIofHC0pAI3btFnLS
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
JT21Y-M8C8UeW7GMIemzGxSnE4KbD0uRqz7bMxxeNXCyA5feOogW6w==
22.60abd8a0.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
47 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.60abd8a0.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
3bb9514ceb027af58b76354d0fcf9f53eb457263d0a3fe4b4a4bd0a316f6eefe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:06 GMT
server
nginx
etag
W/"285512dbd5a26d7c7928dbb0c2be7b44"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
5LiOvAGy9icMMpwC4P8ASiCnJMXQGSFn
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
9VR7_T0T2DTBBK3MpLB8cJvi6T2UKQAAodG1T5eMeqAM0p9MBzYJIw==
13.586051ac.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.586051ac.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
44fca120e89dd9f1c8e69a4535af1fc371b0dc4d0bc91bf455dd432ed6cfc8d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 20 May 2022 15:58:21 GMT
content-encoding
gzip
age
179655
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 20 May 2022 15:32:33 GMT
server
nginx
etag
W/"827cdb78e717e1c7ffddf2832f0345e8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
5U227lEUrMa1_ziDNoBCnnHVIFNZPhTA
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hfLn-isCycc7Mhi6Izob5lJJRXTm03rYkA15TNjc2qmM92onEGuGsA==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:34 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
f0vFdvUsVaxkS7BUVekCPez6OhG1f.hd
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
lfSv0gNgZuTO4Y3BzI83Q86V33bL6KIpmJhfQ52NeuvFi5cztHjh4g==
24.81d46fe7.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
33 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.81d46fe7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
e7e2024764e94bff400b354a7cb714ab75f1b9fd4b3fb09de18dca2d6c2e56a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 22:12:26 GMT
content-encoding
gzip
age
4131609
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:19 GMT
server
nginx
etag
W/"4f751bc7b45f18c1d343a3081fe2509f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
dJ6wMYR.EkVgKolqllYLjIlhrPfZzaVa
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
MP6npzDDoai2OO1M1Qk9yHM2xHuu91yn9uGmpZzMWE30N9y4oNjvjw==
25.c667535c.chunk.css
js.driftt.com/core/assets/css/ Frame 343D
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/25.c667535c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
8b7be87db71855fe47b30e1a60953e25a0e6a832e4ff3fefa682cf74d9e66cf0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:33 GMT
server
nginx
etag
W/"5d56f3a89744b768e05433ac1e2f7935"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Yw4dEFczUjGKvjvS8RVZki_SV8inukYJ
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zzhEawDtGiWiK_U1iEWnDYkpStqf1_YK8JTc4MOyfTO8M16bvVlxlg==
25.17da01e8.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.17da01e8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
f12e00e6750c744bb34c0b007ef96948e24c6dcf77a34c78c0c4f1263c81ebdd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 04 May 2022 19:13:20 GMT
content-encoding
gzip
age
1550356
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 04 May 2022 18:28:30 GMT
server
nginx
etag
W/"d395884071f100b30a64f9bd39a2f10f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
04iRp8gDacN_nR2237idSokHftX5jSZO
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
8MpJ2Z2AHDRfdrrCRH_SRUpG2T5aYz8Kib6koH72UaZrJZ13mpB-sA==
17.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 343D
365 B
1007 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/17.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
365
last-modified
Wed, 18 May 2022 17:52:03 GMT
server
nginx
etag
"06b2963b029c0824382815165bfea73e"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8PhpnUwCKVw_tmw5w1.GT3kRVBeTcpzl
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
XRoD2Fadjo7K-WRniCN7VAlIfUhzibtu0FZMU68sEjUoy4a3FRnNeA==
17.0057716c.chunk.js
js.driftt.com/core/assets/js/ Frame 343D
86 KB
24 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.0057716c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
466e779f85a3564bff7af2474f05fb2b70e2535805e3f707c7d521c24fbad241
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=725d307c-9139-4983-ab48-79bb864ba4e3&sessionStarted=1653241956.046&campaignRefreshToken=87e9b1ae-7fdb-46d0-9c15-108fadaba560&hideController=false&pageLoadStartTime=1653241953529&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 20 May 2022 15:58:21 GMT
content-encoding
gzip
age
179655
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 20 May 2022 15:32:34 GMT
server
nginx
etag
W/"7f01e823ee3c09f0ede254bc3383b747"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Ag_VnHQVWHWsdFwJ39hYWanc.pHSCCnB
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-O0mSsBQmmmY045_5Iq1wx5Udw61T29OOxcWs6lyc3SzLmmSC5HtvQ==
runtime~main.17bd9f4a.js
js.driftt.com/core/assets/js/ Frame F23F
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
55c6067b4d7ebfef0949105fd3947512f88922efe2a18f8423b021b5d6cc120f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 20 May 2022 15:58:21 GMT
content-encoding
gzip
age
179655
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 20 May 2022 15:32:36 GMT
server
nginx
etag
W/"d627a17955a521f542d51e9f006d567f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
HHWWd3wdR5lWRU0LmSDDHF0MbK6.uehk
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
U8g8C-UAQe1baMAjgAoyNL1KUi3qQ-gOBlIIIptmAv_LxqbdYp3YNQ==
5.b4ccdd57.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
58 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/5.b4ccdd57.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:05 GMT
content-encoding
gzip
age
4787311
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:37 GMT
server
nginx
etag
W/"bf2b7dc96b40587d388df8918a276f1d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
gPWEytTOik4qOc_CalZVIUqNneMaJOup
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
1GZiRxDZtdMtubQuuqAPL6gYcDPuM7VGxvfGRVnoekARdNOpzkr1Sw==
main~493df0b3.e4b52ccf.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.e4b52ccf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
d862322f40f2d63eca24e2e6188d0a164bf431db27369bedebb31c357985f7f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:08 GMT
server
nginx
etag
W/"69362f73a04491df20548a6acabbd746"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2zxmXJCeUVcrAdxDs6oDiJa7iJ7fH8N.
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ex3dsaUOhYM0bDwE4fnd3ilrTShwCVLM8-ZbdMb18rk2Ta4oyGJPHg==
44.36014458.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/44.36014458.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
73aefc68f91234a52983d4c0a8037888d05af3f62d6e9b97993ebc4cb5791cbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 10 Apr 2022 22:49:34 GMT
content-encoding
gzip
age
3610982
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 08 Apr 2022 15:57:16 GMT
server
nginx
etag
W/"f3141bda9ba639e2d01218d7e7cd8311"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
B5nQx62kfGixFNs6i7158XuE6Q0q4UA8
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ywSJrjAjxE2wdjPbBV8vjvmFrwG6js0olObXkkOjh4YFqyZVEVaoyA==
19.c2c4ec2d.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.c2c4ec2d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
24caab840126c1089470704d65dcbb1dadc8ace5328b28de54b297e482ac3c3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 22:35:26 GMT
content-encoding
gzip
age
2315830
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 25 Apr 2022 20:45:35 GMT
server
nginx
etag
W/"ca27a219f5babe50f6eb7c982fa61d4a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
GP6AWJ95Oeeek71gysVMlYSExP067DB1
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
GfSChN5_wc72Yx6ho50qvx596zdCm0IsaRDxSxQm-kf5WOX6hVlGRQ==
37.dc112dfd.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/37.dc112dfd.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 05 Apr 2022 02:06:54 GMT
content-encoding
gzip
age
4117542
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:20 GMT
server
nginx
etag
W/"391f6f28819c5b154653979d5154c888"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
vKbfuupFATroRl3aNDGfs3ThogQLzb9z
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wY0tnT6btQqsGYDU_eA4MuNmtA2555LLCpsBZETagnFiEL86yX9Drg==
16.10d76686.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.10d76686.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 04 Jan 2022 15:53:42 GMT
content-encoding
gzip
age
11930334
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 04 Jan 2022 15:08:17 GMT
server
nginx
etag
W/"c16e855d0a26bf91ae3cc32cdbfa3ad6"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
mzB2ul0u_48ftIGEd6phwcoTfextzATL
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
aQ423iKDrtvikJYDmqaMtpWdVg4NVpqDfXM-DQ0qvF1aI6UWEM0dOg==
21.8ac5d777.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
72 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.8ac5d777.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 05 Apr 2022 02:06:54 GMT
content-encoding
gzip
age
4117542
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:19 GMT
server
nginx
etag
W/"c39414a669b98ba4a25856ccdc1c1c1b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Ilpiiyhlyh6s3iuNf.37uZlW5ugPpx91
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
L99BiGUJv5DvjldlPFURiiLfY3BSeXiPkxz5HWzaXXPD75Fk9SQHPQ==
34.801d3c89.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
16 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/34.801d3c89.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:36 GMT
server
nginx
etag
W/"fa218b0849860dbc5ceda153316c9c38"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
lKdT83hFk6oc4yzwjkCPtmRufEzn_1y9
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-auCw-rkF1x6fgnzhjAwrObHjg4lLr9SReiG_IHU3Rnvg4cJEc8Zww==
23.16e779ff.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.16e779ff.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
882447805fc1c7805ad98684a4698c4b3ae5e8932261c609f7cdd0834275d72c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 13:25:10 GMT
content-encoding
gzip
age
3212846
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 14 Apr 2022 14:51:25 GMT
server
nginx
etag
W/"ef4446c0fdb98929baf632c38e8cd226"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
6QFFV552d_qyZ9pcsgZNY8fkBisjodK4
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
D1dTH97HKK5Q4Gyh5i0e14tpfP-wumS69U8CxmkHydXEHwOL_RlrdA==
11.8d62d6c4.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.8d62d6c4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:35 GMT
server
nginx
etag
W/"8199a8634768214fc6204b18351f842d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
IO06C9jhzvCi9VImuydD04sGtIPTZ6T.
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
C90ID70zXDboB8LDGRkeed7pxwkyG4c3boc50ga12yI34PAd2GZysQ==
10.b73b895d.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.b73b895d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
494a73882e211c16a50493069a632e339e15d32fd8519f22766a0a0e235f7d01
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 12 May 2022 17:56:16 GMT
content-encoding
gzip
age
863780
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 12 May 2022 17:28:59 GMT
server
nginx
etag
W/"5c6cb58ced9f55b696578307366a68ac"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
42s0ZS8AeOMe_PH.Rce3w4xkhbhmKcpn
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
H7VHb1lkcAynUGblNyoDLREtXi8XdGb0YnzumZpHkpf1b-cfLZ41rw==
14.2a01ddd6.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.2a01ddd6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 04 Jan 2022 15:53:41 GMT
content-encoding
gzip
age
11930335
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 04 Jan 2022 15:08:17 GMT
server
nginx
etag
W/"6f457384188c98017d8d27281f3df6ad"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
KpoEpDmO7G9TLWLfSTzA1dytLAyREIfM
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
S8ErGkRHa-bVMCIN79HqyIOICos4H9-_5cPesbPJ1fFkEsK6jG3aBQ==
42.85bf5aa5.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.85bf5aa5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
b70c36674f1298febe27d175904d872013535e9b0e20136b5dd86bb51c2729e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 10 Apr 2022 22:49:34 GMT
content-encoding
gzip
age
3610982
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 08 Apr 2022 15:57:16 GMT
server
nginx
etag
W/"8c7c0bf11a78a30db0b2b7f63660c3d1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
mxBFWZx1wZ1xN.1nj_wZKtLvuDeu4lk_
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
kkz7B7L3H0vkE7nsvrIXtigdYXC4n5qjIs-WPy9-RGP_Tm6c7e1KvA==
35.0810b4b3.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.0810b4b3.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 22:12:26 GMT
content-encoding
gzip
age
4131610
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:20 GMT
server
nginx
etag
W/"4a61646db5420cc31cb60b9287d9f544"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
0Zui0kJ5MSbHpImulx8UM9hDRN0gPHQk
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ub1UQq4-YIhEFTqBFRh88vmVp4150LhRAQVjibVd2oeViAhjU9rniQ==
26.81342ce1.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.81342ce1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
652cfd16c30cffe323376752f023f8f9738af74b807bda8e929ecba78d9ed19d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 13:25:10 GMT
content-encoding
gzip
age
3212846
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 14 Apr 2022 14:51:25 GMT
server
nginx
etag
W/"fb3937eee6b2751c3fc0c91dce12c2ca"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Kb9jiolYAspdT0T2FEuoVylYgxdOCuEs
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
W8En8kvU3-htNADOBTqPr1TNJIxVoroGvBPliYOhTaqlzyMW1C5Iww==
18.3ca2a055.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.3ca2a055.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
5dad1cd9bd8a255538159566f3a5621e4dbe821ab334c23acd443810b950bb88
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:06 GMT
server
nginx
etag
W/"4cfccba39f0ab35f70bc772f1d0eb4c2"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
AOsH7T1Yo.NhD3RTtLUBAEdTLdlQFzkv
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ghe4fIha6tnyZRJ808w3FpSUtTf9CP7Zf_pYIZTZJMfVy6nbxiJeRQ==
8.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame F23F
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/8.5b0bb1c3.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
02840352581026aad3291a8357da6876c93b0e6d8aec9532bbc1a42f82bca1c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:33 GMT
server
nginx
etag
W/"e3c43c4a3d2f4cee45cccdb6e438af66"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8ZsEKgx7NBbOWsOo7y482B7LIK3_mShC
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
aR9Myxq8Vxq58xXIxbQS0Mer6C-fwTM4RNROt9G0xnwm2_th5jCM6w==
8.8e3b3a7f.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
71 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.8e3b3a7f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
ca7362fcc0e9111db58886105f1f991c5090eeed7b08e2892612704f3be1c4c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:07 GMT
server
nginx
etag
W/"45dc590878796b9b88476ebcc9b9d3b8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
OmX6mBr67Bd69RMnY4ee.6RCkJcoZI8v
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WXyqM9ne-vp0i5yF3-fr1DynLFmpuDUMFLUfeWctwS5u7eZRAEk-Qw==
15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame F23F
24 B
668 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 04 Jan 2022 15:53:41 GMT
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
age
11930335
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Tue, 04 Jan 2022 15:08:15 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
bzo2zbrJexGHlTPaLulG8N5yfdXT7FR0
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wOZsSJu8jwBVi_2FBrObfNmCQYRVWJjZQdBEDSojMAsDqZdkeUhtbA==
15.b05dc660.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
78 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.b05dc660.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
6da17efdd329929b537064639b37368da51734209944097eaebd4ab6e2acd3ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:05 GMT
server
nginx
etag
W/"a58ddbf68856497e42c8020066e03bae"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
LENnMtbvszMAu5pFIofHC0pAI3btFnLS
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
W1Lj8qIANPTYcvualzupQrzXto-js1tgw-Q7gT8Frll_MNo_pfezSw==
22.60abd8a0.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
47 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.60abd8a0.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
3bb9514ceb027af58b76354d0fcf9f53eb457263d0a3fe4b4a4bd0a316f6eefe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:06 GMT
server
nginx
etag
W/"285512dbd5a26d7c7928dbb0c2be7b44"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
5LiOvAGy9icMMpwC4P8ASiCnJMXQGSFn
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tijTuthZ06KaDUcsKoLabm6frQYs6ypiYecvMLbDsr8d5SZKNH51WA==
13.586051ac.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.586051ac.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
44fca120e89dd9f1c8e69a4535af1fc371b0dc4d0bc91bf455dd432ed6cfc8d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 20 May 2022 15:58:21 GMT
content-encoding
gzip
age
179655
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 20 May 2022 15:32:33 GMT
server
nginx
etag
W/"827cdb78e717e1c7ffddf2832f0345e8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
5U227lEUrMa1_ziDNoBCnnHVIFNZPhTA
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zAyFls71uprheAdDeUuqaoUJ5Od0ZVtqBoSCaBA52bhQTDt3cDHwng==
32.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame F23F
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/32.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 22:12:26 GMT
content-encoding
gzip
age
4131610
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 04 Apr 2022 18:54:17 GMT
server
nginx
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
o4YHS2mkjmPJ8FYb.psnWR.Z9AgjdeMR
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
IAOwpnt71PeIb_G0lNbbyk7MYyM8YV6wlnS8cjL3akwdKDxnm25HoA==
32.28be7b35.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.28be7b35.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
566639f88e650ada50f7f5a70d52efdd262905b7114ddffd26893b7727493a7f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 14 Mar 2022 01:21:23 GMT
content-encoding
gzip
age
6021072
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 09 Mar 2022 19:39:00 GMT
server
nginx
etag
W/"853d736e05b299b857e10b6ab17f3c36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
nKLZ1eCZgJyATnvQHZL81PT0kMSSnbMT
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wbSzUzH7vYWDtU6pPFpAj9UdF5oMp0HbjZAvTk4oCk_Py-j_QUhyGg==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787310
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:34 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
f0vFdvUsVaxkS7BUVekCPez6OhG1f.hd
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tHxF9Xrh4CkpOPluqeUeTAy4xeLu0-OWBFzGsRfjfEs25Vw4sPMbTQ==
2.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame F23F
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/2.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787309
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:33 GMT
server
nginx
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
eJJ8iIcGQeeOyHqQZhPH9NjVmZe46DWE
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
lU1wwhAIMTYG5VZz6y4zpBAkcrDLbibOjAnASOwMbokCED9Xe8xUEA==
2.90bfb041.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
54 KB
16 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/2.90bfb041.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
088e1ef91a320f014eecd7495cedfa7fee5e167cadaf55545ce137f4ff749ba8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 01 Apr 2022 23:30:53 GMT
content-encoding
gzip
age
4386103
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 01 Apr 2022 18:31:22 GMT
server
nginx
etag
W/"dc43e7dd478d83a9091a7335b8beb11d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
kk3GS24HgDEmPXUslSsjyTbGLAUWg7zo
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
mj_PQXF4EVCv0dpGafslS4cvLFxW12jZgqspKRrhQ3J7nyZj2khyyA==
1.e5dfd51a.chunk.css
js.driftt.com/core/assets/css/ Frame F23F
43 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.e5dfd51a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
731633bd497e93880bccb08fa09fa7fc7630372c7622dffea00c19aa2cdc49d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 02 May 2022 15:02:23 GMT
content-encoding
gzip
age
1738213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 28 Apr 2022 15:26:46 GMT
server
nginx
etag
W/"2c40725f3e291f40133c5dd42e2d2809"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
NDVBsNLgITAyanG2chz6_hhZC25SbNrt
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
vPRUBGFOpuwu0HnGBlxlIaczi67pzDxBejGupk7cKJZ8DZIXEburiA==
1.af2c0498.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
73 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.af2c0498.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
e1e4797eacb227503cef66a6fbd3d16197aacdcfb52b915c9dd5de35d20973ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:05 GMT
server
nginx
etag
W/"06c00cd10988050423566fb804ecaca2"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
bkKzkpW1r..rd9z2pPD3kv.guYN7Upim
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
U30EZVcperzE0XWcJbmghZ91CFMhOEEndsTArhLj6CK6V5ywoD8KWQ==
30.52060f2d.chunk.css
js.driftt.com/core/assets/css/ Frame F23F
12 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/30.52060f2d.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
643284a0eca0e88605a52952545149695d41d4a6f057d897bedf92a24e32c573
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 08:04:06 GMT
content-encoding
gzip
age
4787309
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 25 Mar 2022 20:18:33 GMT
server
nginx
etag
W/"b63021470083bdc161ef4dda2e4912c3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
pHw9X_j3lnHYAPELEWozrhov_rOIKMZh
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
59TsLClqGNAMx5HU8cQiaDYBHKdGlhO7M4TWflQmFpc2yHGe-UiARQ==
30.c3864c88.chunk.js
js.driftt.com/core/assets/js/ Frame F23F
11 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/30.c3864c88.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.17bd9f4a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
79c254652bb96247b5470d8d7d30bdef4ae96a7e61743ac4ef6b423502cd8c51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1653241953529
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 17:57:10 GMT
content-encoding
gzip
age
345326
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 17:52:06 GMT
server
nginx
etag
W/"38d96c6ccd18212a914f55851e7dea75"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
C5YkLjESeiAIo2wT8c7vzTOlJV8QbN5A
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P5
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EZ2jF4vu7jJVoNLd1drghRlDGAzQBJ4uet4HLx0ZFG7unEQ_vG3Vxg==
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Sun, 22 May 2022 17:52:36 GMT
requestid
driftc4ba4d042f3866a96ac2624995d
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
0
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 343D
25 B
122 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/44.36014458.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 22 May 2022 17:52:36 GMT
server
istio-envoy
requestid
cf6b5cae20aae8fd
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
41
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame 343D
177 B
275 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/44.36014458.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
fa8c32e4cf3d3e6a515ed02bcb7c24c87a1371ff8b888ca12332e4da8e4c5e65
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 22 May 2022 17:52:36 GMT
server
istio-envoy
requestid
c88ce56e28455e4a
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
177
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame
0
0
Preflight
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Sun, 22 May 2022 17:52:36 GMT
requestid
drift6f43ccd4abdb13f3574b14fe521
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
0
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A35%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:36 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
ip.json
api.company-target.com/api/v2/
444 B
950 B
Fetch
General
Full URL
https://api.company-target.com/api/v2/ip.json?key=79a80d0e3f65c8809c2d2c9dda90c2b5&page=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&page_title=University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US&referrer=
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1653242100000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-20.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
c3e093146fad0e34b98a7b0f9e57fbe4ef571abfff63b3af50689b20f8718a41

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 22 May 2022 17:52:36 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA56-P2
x-cache
Miss from cloudfront
request-id
3723fc84-1680-4f85-875d-1743e5497a06
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.proofpoint.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
p5Yv3hUhb78qoM1iTCdOKmLlBvS9H1br7UD-CXJHuCGs0FyYX5foLQ==
expires
Sat, 21 May 2022 17:52:36 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A36%20GMT%22%2C%22timeSpent%22%3A%221007%22%2C%22totalTimeSpent%22%3A%223013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:37 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
j.clarity.ms/
0
48 B
XHR
General
Full URL
https://j.clarity.ms/collect
Requested by
Host: j.clarity.ms
URL: https://j.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.85.30.134 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Sun, 22 May 2022 17:52:37 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 343D
25 B
88 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/44.36014458.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 22 May 2022 17:52:38 GMT
server
istio-envoy
requestid
970eda6fb2fc338d
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
17
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Sun, 22 May 2022 17:52:38 GMT
requestid
drift71daa6e4194be7f081cbe6fa9d1
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
0
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A37%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:38 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A38%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%225020%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:39 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=cbd5ce17ad49000062788a628602000008fa3800&session=75bd6a22-94c8-4588-8307-23f0e34d44d9&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20May%202022%2017%3A52%3A39%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226021%22%7D&isIframe=false&m=%7B%22description%22%3A%22Proofpoint%20researchers%20have%20identified%20an%20increase%20in%20email%20threats%20targeting%20mostly%20North%20American%20universities%20attempting%20to%20steal%20university%20login%20credentials.%20The%20threats%20typically%20leverage%20COVID-19%20themes%20including%20testing%20information%20and%20the%20new%20Omicron%20variant.%22%2C%22keywords%22%3A%22Credential%20Phishing%2C%20University%2C%20Education%2C%20COVID-19%22%2C%22title%22%3A%22University%20Targeted%20Credential%20Phishing%20Campaigns%20Use%20COVID-19%2C%20Omicron%20Themes%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Funiversity-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes&pageViewId=6cea2fde-7a3f-469b-8797-f9eaa9a02e4b&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Sun, 22 May 2022 17:52:40 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

229 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| dataLayer object| google_tag_manager object| google_optimize object| NREUM object| newrelic function| __nr_require object| Modernizr object| MktoForms2 function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| google_conversion_id object| google_custom_params object| google_remarketing_only function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_tag_data object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments function| ownKeys function| _objectSpread function| _defineProperty function| _ function| jQuery undefined| $ object| Backbone object| drupalSettings object| Drupal object| picturefillCFG function| picturefill object| tabbable object| Cookies object| geoip2 function| _toConsumableArray function| _nonIterableSpread function| _unsupportedIterableToArray function| _iterableToArray function| _arrayWithoutHoles function| _arrayLikeToArray function| BaseClass object| webpackJsonp object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| FontAwesomeConfig object| ___FONT_AWESOME___ boolean| VimeoPlayerResizeEmbeds_ function| subscribeToMarketoFormEvent object| addthis_config object| addthis_share object| MunchkinTracker function| postscribe object| google_tag_manager_external function| __extends object| Demandbase object| __db function| DBSegment function| ga string| GoogleAnalyticsObject function| twq function| hj object| _hjSettings object| parts object| vimeoGAJS string| _linkedin_partner_id object| _linkedin_data_partner_ids object| _vwo_code number| settings_timer number| _vwo_settings_timer object| _rctfl string| axel number| a function| drift undefined| driftt function| fbq function| _fbq object| techtargetic function| lintrk function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| google_trackConversion object| GooglebQhCsO function| UET function| UET_init function| UET_push object| twttr object| ueto_cfad3c3c22 object| uetq boolean| _already_called_lintrk object| gaplugins object| gaGlobal object| gaData undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| vwo_iehack_queue function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| c function| _rtfl_jsonp_0 string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks undefined| adroll_tpc_callback boolean| _storagePopulated object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked object| __adroll_consent_data boolean| __@@##MUH object| adroll_exp_list object| jQuery112404634172566552661 number| timer_e boolean| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| adroll_currency object| adroll_conversion_value object| adroll_conversion_value_in_dollars function| clarity function| dbAsyncInit function| Sizzle function| db_hook_init function| db_hook_all_hit function| db_hook_response function| db_hook_no_id function| db_hook_attr function| db_hook_before_parse function| db_hook_after_parse object| jQuery112108702892874550276 string| adroll_seg_eid object| adroll_form_fields string| adroll_rule_type object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id object| oattr

83 Cookies

Domain/Path Name / Value
www.proofpoint.com/us/blog/threat-insight Name: hide_lang_switcher
Value: 1
www.proofpoint.com/us/blog/threat-insight Name: pp_user_country
Value: de
.proofpoint.com/ Name: visid_incap_177663
Value: 9S1aAAZLR/aFpGRjh04m5194imIAAAAAQUIPAAAAAACZVsVb119XkBHOfsbj8d5t
.proofpoint.com/ Name: incap_ses_1288_177663
Value: hnS8MKuGX0sz4mx4qOXfEWB4imIAAAAAwBz86UQhA7SiNrO1YrXyUg==
.proofpoint.com/ Name: incap_ses_536_177663
Value: jiuofDYr4153nSEIzEFwB2F4imIAAAAAbqpPi8FQZOdRA81nmCYhbA==
.proofpoint.com/ Name: incap_ses_408_177663
Value: VRs7VTwFqgFm8+3MHoKpBWF4imIAAAAAQaerfvh+FOmJgQISsLGVMw==
.proofpoint.com/ Name: incap_ses_247_177663
Value: Zgq9ayH2rUg3QBTjC4ZtA2F4imIAAAAAxhsE19XhjV4pNMQDjL5NTw==
.proofpoint.com/ Name: incap_ses_245_177663
Value: 95dWBnqPOkXoFA1i1GpmA2B4imIAAAAAo8RFI7SixIaM1YYpGQ9WGA==
.proofpoint.com/ Name: incap_ses_8219_177663
Value: ELsOZPb/iX3jBpBVX8EPcmF4imIAAAAAA7iX9rtSlNPsM5NGBEQaQA==
.app-abj.marketo.com/ Name: __cf_bm
Value: mJ8GRe1QN2fi8KFse7QERSulsaIw2LfJ_BBHH9dOsr8-1653241954-0-Ae4WNb+LkJ1o9UyQTiqMcf4W61lD4ppGc8aj3le6wjqfzi+VQYoxdM1BXUhxYx+Ft9GIAI2W9KCqIm17ZG0Le44=
.proofpoint.com/ Name: _mkto_trk
Value: id:309-RHV-619&token:_mch-proofpoint.com-1653241954260-74535
.proofpoint.com/ Name: _gcl_au
Value: 1.1.656036162.1653241954
.bing.com/ Name: MUID
Value: 31C77FBE7F60624B2D8D6E127EB263F3
.proofpoint.com/ Name: _uetsid
Value: f5b35150d9f711ecae13b9ee3d12e50f
.proofpoint.com/ Name: _uetvid
Value: f5b3b0e0d9f711ec893f4343f08a5f7c
.proofpoint.com/ Name: _ga
Value: GA1.2.1400234525.1653241954
.proofpoint.com/ Name: _gid
Value: GA1.2.262237260.1653241954
.proofpoint.com/ Name: _gat_UA-2257074-1
Value: 1
.bidr.io/ Name: bito
Value: AAHSNU7FFPEAAExKDq0dVg
.bidr.io/ Name: bitoIsSecure
Value: ok
.proofpoint.com/ Name: _vwo_uuid_v2
Value: D0AE54CA347B00B7826F5418295675F1B|2b177130be46e415170869a41d66314a
ads.avct.cloud/ Name: uuid
Value: 8084c3b0-daa3-45e5-9ab3-81011560a719
.company-target.com/ Name: tuuid
Value: a1f3f699-4950-47ea-969b-2ad0ce6aeb63
.company-target.com/ Name: tuuid_lu
Value: 1653241954
.www.proofpoint.com/ Name: _rtfl_s_handshake_guid
Value: f1ef9935-787d-4c1b-9ac6-d30d544127d2
.doubleclick.net/ Name: IDE
Value: AHWqTUmF-rDfHXtoClbOGutZvNOl0TIL3KQxUOXAf5YpvLP9SvuTRaJzNUQ9bHueJO0
tracking.g2crowd.com/ Name: _session_id
Value: 197622e80869fe2f9f2f61e839e2c817
.g2crowd.com/ Name: __cf_bm
Value: EhMhxtfalz50kPlJCzWIGkV4SOSgn0WloLqWlScK.JU-1653241954-0-AbtrdhqgUTV0TqQ4kc3BohdCrIc59Y7wpvYj4aR/b/Lr7ba3Ar2cHWE+3exW/6GbnYoLbrZKXGkVwgGYjCX5YpY=
.6sc.co/ Name: 6suuid
Value: cbd5ce17ad49000062788a628602000008fa3800
.techtarget.com/ Name: __cf_bm
Value: hpwTbCZjFf7CZSQAc3fjVd0vehw7bi0j0OO7jGUW7pg-1653241954-0-AdgelDou8aL58FKXcvyJjuckxCyvCisucbC1sfS0mVMefIbr4BMsBe2vbL8tkxDpZxEMSfdNr7ZjqsqPItNUjck=
.mathtag.com/ Name: uuid
Value: 895e628a-7862-4f00-82b4-b05e7170d524
www.proofpoint.com/ Name: _gd_svisitor
Value: cbd5ce17ad49000062788a628602000008fa3800
www.proofpoint.com/ Name: _an_uid
Value: 0
www.proofpoint.com/ Name: _gd_visitor
Value: 429c9285-17b6-4ca3-8445-3143ce4a6ea4
www.proofpoint.com/ Name: _gd_session
Value: 75bd6a22-94c8-4588-8307-23f0e34d44d9
.proofpoint.com/ Name: _fbp
Value: fb.1.1653241954800.1364816593
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.proofpoint.com/ Name: _hjSessionUser_1456002
Value: eyJpZCI6IjY4MGQ1NWQ1LWNhNjgtNWExNy1iZjUzLTIzOTdhN2ExNjU0MCIsImNyZWF0ZWQiOjE2NTMyNDE5NTQ5MDAsImV4aXN0aW5nIjpmYWxzZX0=
.proofpoint.com/ Name: _hjFirstSeen
Value: 1
.proofpoint.com/ Name: _hjSession_1456002
Value: eyJpZCI6ImViZWUxOGM3LTQyZGYtNGUyMy1hYjhhLWIxMDU3OGIwMGMxMiIsImNyZWF0ZWQiOjE2NTMyNDE5NTQ5MjEsImluU2FtcGxlIjpmYWxzZX0=
.proofpoint.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
.adnxs.com/ Name: uuid2
Value: 4231864771467943404
.linkedin.com/ Name: UserMatchHistory
Value: AQLqaRjnZhpXgwAAAYDs5kKAV1OFsmPGDn-Ut8V5nyeJHgLVcnIB-tMXTah8rTOtmSJFrWUc9-c0iw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLwNwop6nSCOAAAAYDs5kKAiepYGO8a023hgRqRc8EJa4-zbku2r3t_ijBc3ChTXt91josgKRxC7GNCiDd4Nw
.linkedin.com/ Name: bcookie
Value: "v=2&3f045e24-80ba-4928-837c-614ce0e7f8ce"
.linkedin.com/ Name: lidc
Value: "b=VGST02:s=V:r=V:a=V:p=V:g=2622:u=1:x=1:i=1653241954:t=1653328354:v=2:sig=AQEP9ThFX86qH8OsvRx6ZV3wkAfquoCY"
.twitter.com/ Name: personalization_id
Value: "v1_PIGPzIbgcmfPzAT3xKARFQ=="
.t.co/ Name: muc_ads
Value: 565f09a3-2f94-4b93-a9bb-1e1592ab9678
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220522175235f44e5caa-f2fa-4d50-8d92-27b861a41bbcAQG4R_A8StOzbpesCfkhB87jX_To2xwt"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NTMyNDE5NTU7MjswMjHkP/GCwAR7RA1PknpZXAbUQicqjl+PB9iF1AaNf0SZeA==
.bidswitch.net/ Name: tuuid
Value: 0b738af6-e530-4164-8e10-a6ce2f46a5a7
.bidswitch.net/ Name: c
Value: 1653241955
.bidswitch.net/ Name: tuuid_lu
Value: 1653241955
.www.proofpoint.com/ Name: __adroll_fpc
Value: c20fe70d16773d7cfdd95f1be3901e1c-1653241955197
www.clarity.ms/ Name: CLID
Value: 882583f0ac724e49a1f3fd9850eaee0d.20220522.20230522
.www.proofpoint.com/ Name: __ar_v4
Value: %7C7YJ7XZCLMRHSVCXIHB5HIT%3A20220521%3A1%7CYV5KYXXEJZATZCT37YRTMK%3A20220521%3A1%7CT47Y2VPPABDUBJXFROMZZM%3A20220521%3A1
.casalemedia.com/ Name: CMID
Value: Yop4Y9a4SDukxb2JdZjlhwAA
.casalemedia.com/ Name: CMPS
Value: 3267
.casalemedia.com/ Name: CMPRO
Value: 1170
.casalemedia.com/ Name: CMRUM3
Value: 69628a78632760ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
.casalemedia.com/ Name: CMST
Value: Yop4Y2KKeGMA
.3lift.com/ Name: tluid
Value: 2585004945740921421177
.adnxs.com/ Name: anj
Value: dTM7k!M4/rD>6NRF']wIg2E?inX4j>!]tbPl@/@8$-^=$U_hB!>qd2DIl>!xHj6L_>9t:n^E'R@:W`O`YPDbGF?ORMLJ`wu_?K1lYZTs$2$XYG3If)y3KL9D3I?+JO/ukm
.pubmatic.com/ Name: KRTBCOOKIE_10
Value: 22808-ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA&KRTB&22883-ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
.pubmatic.com/ Name: PugT
Value: 1653241955
gwmtracking.com/ Name: kwsu
Value: 628a7863d04abd7085d7b831
d.adroll.com/ Name: __adroll
Value: e4e473732c9c6c9a8eb05ab2280276a0-g_1653241955-a_1653241955
.adroll.com/ Name: __adroll_shared
Value: e4e473732c9c6c9a8eb05ab2280276a0-g_1653241955-a_1653241955
.proofpoint.com/ Name: _clck
Value: 1id9a2q|1|f1o|0
.outbrain.com/ Name: obuid
Value: 649e8ea3-ece3-4ad9-b19d-82c25f437b3f
.outbrain.com/ Name: adrl
Value: ZTRlNDczNzMyYzljNmM5YThlYjA1YWIyMjgwMjc2YTA
.proofpoint.com/ Name: _clsk
Value: 1szz3c7|1653241955833|1|1|j.clarity.ms/collect
www.proofpoint.com/ Name: drift_campaign_refresh
Value: 87e9b1ae-7fdb-46d0-9c15-108fadaba560
www.proofpoint.com/ Name: __atuvc
Value: 1%7C21
www.proofpoint.com/ Name: __atuvs
Value: 628a786264fa6b6f000
.addthis.com/ Name: uvc
Value: 1%7C21
.c.bing.com/ Name: SRM_B
Value: 31C77FBE7F60624B2D8D6E127EB263F3
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 31C77FBE7F60624B2D8D6E127EB263F3
.c.clarity.ms/ Name: ANONCHK
Value: 0
.addthis.com/ Name: loc
Value: MDAwMDBFVURFQlkyMjkzMTkwMTAwNTAwMDBDSA==
.nr-data.net/ Name: JSESSIONID
Value: aefcfda3fc22582a

4 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes(Line 809)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/university-targeted-credential-phishing-campaigns-use-covid-19-omicron-themes(Line 809)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10031399.fls.doubleclick.net
10487471.fls.doubleclick.net
309-rhv-619.mktoresp.com
4788165.fls.doubleclick.net
ad.doubleclick.net
ads.avct.cloud
ads.avocet.io
ads.yahoo.com
adservice.google.com
analytics.twitter.com
api.company-target.com
app-abj.marketo.com
apt.techtarget.com
attr.ml-api.io
b.6sc.co
bam-cell.nr-data.net
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.bing.com
c.clarity.ms
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
data.adxcel-ec2.com
dev.visualwebsiteoptimizer.com
dsum-sec.casalemedia.com
eb2.3lift.com
epsilon.6sense.com
fonts.googleapis.com
geoip-js.com
googleads.g.doubleclick.net
gwmtracking.com
ib.adnxs.com
id.rlcdn.com
image2.pubmatic.com
ipv6.6sc.co
j.6sc.co
j.clarity.ms
js-agent.newrelic.com
js.driftt.com
m.addthis.com
match.prod.bidr.io
metrics.api.drift.com
munchkin.marketo.net
onetag-sys.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.sitescout.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.adroll.com
s.ml-attr.com
s7.addthis.com
script.hotjar.com
scripts.demandbase.com
secure.adnxs.com
secure.chip2gift.com
segments.company-target.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.outbrain.com
sync.taboola.com
t.co
tag.demandbase.com
track.accountinsight.cloud
tracking.g2crowd.com
trk.techtarget.com
us-u.openx.net
vars.hotjar.com
visitor.reactful.com
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
www.proofpoint.com
x.bidswitch.net
z.moatads.com
s7.addthis.com
104.111.234.67
104.16.96.80
104.244.42.131
104.244.42.5
104.75.88.126
108.138.17.72
108.138.17.96
13.107.42.14
141.226.228.48
142.250.184.230
142.250.185.66
142.250.186.162
151.101.194.137
158.255.109.19
162.247.243.147
18.66.112.55
18.66.139.84
18.66.97.20
185.64.190.80
192.28.144.124
199.232.136.157
2.18.233.201
20.85.30.134
206.19.49.24
216.200.122.11
23.35.236.247
23.35.237.151
2600:9000:225e:8600:6:9280:1080:93a1
2600:9000:2490:f400:12:3734:2a40:93a1
2606:4700:4400::6812:2437
2606:4700:4400::6812:264a
2606:4700:4400::ac40:91d9
2620:1ec:22::14
2620:1ec:27::cafe:2154
2620:1ec:c11::200
2a00:1288:80:807::2
2a00:1450:4001:801::2002
2a00:1450:4001:802::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2008
2a00:1450:4001:828::200e
2a00:1450:4001:82a::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:831::200a
2a00:1450:400c:c0c::9c
2a00:1450:400e:810::2013
2a02:26f0:3500:7::17d8:4dd1
2a02:26f0:6c00:296::1c91
2a02:e980:107::cf
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
3.121.14.2
3.124.34.143
3.226.141.76
34.193.113.164
34.96.102.137
35.244.159.8
35.244.174.68
37.252.172.123
37.252.173.38
51.11.20.152
51.75.86.98
52.142.114.2
52.213.228.15
52.222.214.8
52.222.236.74
54.147.21.139
54.216.196.145
54.220.64.232
64.202.112.191
66.155.71.149
68.67.153.60
69.173.144.139
76.223.111.18
96.16.137.162
013ebc8682bafe775a56f93904cff8456974906327dad3524e2ab2fe0c0df700
02840352581026aad3291a8357da6876c93b0e6d8aec9532bbc1a42f82bca1c5
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52
071183eb26b32d0683f2a2536731b42fece4b9d02ec7ed06659f66e6a9762490
084390577243b6986d5564d152916a37a3124305e11b2817d0c2eabc863e081b
088e1ef91a320f014eecd7495cedfa7fee5e167cadaf55545ce137f4ff749ba8
0a2abd304c977f8b8e4b3c9d0268fb12f7ad321d995c8245a7d737f2fdef5dda
0a9adccc17d9e34e3971bce91e3723f1fef884844fed6e6e10085e19745faef5
0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12f912f4fa15bfc798701449ffa17fb4ee53df0a64211ce962ee58864585d449
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab
1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63
1d4652e5179586612a28123daf3428e1aa5c1bbad11c6a136c9f2f98fa823dcf
1dd045da6e00e9d34ddd4f5a29d9377a6cc0b6ea617bbb21f18cd13a3f806a16
1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70
21a254503a86c922c5d938d8828b1cee40c60cdd1c8e2ac1e7f72f2329705798
221cd3d962c913d9fe237b497336bc20c8a156e7898f4b2463ba24a4d07079dc
24caab840126c1089470704d65dcbb1dadc8ace5328b28de54b297e482ac3c3f
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
26253bc4b0f3d7676d47355ab83b5d500d1c61bda91082a8384fd07e6de5cd52
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
332a6273af6fdc033f936b6754b3c8af335763469fe94ac2fc3246273d4c63e0
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3bb9514ceb027af58b76354d0fcf9f53eb457263d0a3fe4b4a4bd0a316f6eefe
3d45fdf57e5fd666b1ff640d125a0f6e7a8edfac5055af0885b29ff442d85007
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb
41dff0bd88ed8c2db1d7cd37dc0d2f42e06e5003910603af32ae7fd4c1ac09b4
43b21a37ead752a35feeeb473aecb119bc2b63800594adc825bcb903b81f23da
44a3d4b27fb8f45a3d8b610f1972d02698df05aaa1986cc3b1429a13830f0c80
44fca120e89dd9f1c8e69a4535af1fc371b0dc4d0bc91bf455dd432ed6cfc8d6
466e779f85a3564bff7af2474f05fb2b70e2535805e3f707c7d521c24fbad241
4845e9f0ab8138835df66e6fb4d2f369f72c93c65b45cd8e545055e0382d08b4
48d42d796259ce76ce16275405ab9caa59e6d6867987dabe5a329b5ac15bf5c2
494a73882e211c16a50493069a632e339e15d32fd8519f22766a0a0e235f7d01
4ae6251cfcc9e182aa356d2cb61eafd3679ae48d5c50bb6a7fed4e624120cf30
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd
4d71e28edcd31a762462d68b69b58c84965188c5f19c64f9d55fe0520e33985d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f3fc31f17996bdcd89a0b6358ef30b10a4d5b8e436dcd786082965f868f3bd8
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0
5475ef880793a875564088fea38154cee107eede5a2af036f3774a3dec5e48e6
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
55c6067b4d7ebfef0949105fd3947512f88922efe2a18f8423b021b5d6cc120f
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
566639f88e650ada50f7f5a70d52efdd262905b7114ddffd26893b7727493a7f
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
59078faaffb779d8762c4094f67d06031557b01856f955dbf4d40098b215b961
5d6bee75e36a646121b34acd20bae27cd992624203e1d02b5f6db9c44408bc10
5dad1cd9bd8a255538159566f3a5621e4dbe821ab334c23acd443810b950bb88
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
643284a0eca0e88605a52952545149695d41d4a6f057d897bedf92a24e32c573
652cfd16c30cffe323376752f023f8f9738af74b807bda8e929ecba78d9ed19d
67f8c7fd7353ad063da1f3115924c458c494cb134f4d87de4407a132842c9bc9
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
6907f421de451fd5e7f962c48d39191bd7d86390df35df8b416d3ca0eb558436
693d949d8c3fdc7fd4ace7c340b5f177a9f0c5be7bafee8bc93a7d88b7523d75
69a12e6a2c6dff14902de0fec7a22b138a389be30d22265fa1f3c629373c295e
6da17efdd329929b537064639b37368da51734209944097eaebd4ab6e2acd3ce
6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708
731633bd497e93880bccb08fa09fa7fc7630372c7622dffea00c19aa2cdc49d1
73abcdba8b61ea9513c74192393cecce485ae1243f56c1cde5d61cd95650279b
73aefc68f91234a52983d4c0a8037888d05af3f62d6e9b97993ebc4cb5791cbb
7466d898b42d133a1f572707e865e18a42cd25becb49bddd4807dda4121e9839
759fa142a354ae5300607b79d384f4e88d5b2df3d14e73c95c06daadae623076
785386e38e422ac73429f53fc111599e675d9a02d75b3320c6c85d7df42fd232
79c254652bb96247b5470d8d7d30bdef4ae96a7e61743ac4ef6b423502cd8c51
7a0b6416d78629bad35ecb1e704805e5185a113703ddbbaa44ef632423cbafad
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551
8052a6fb6e64307417bdc20498d493634e5dd08188191d36dc64cd9672165e5a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83558280bd3246b6d9fc7ad2201d784dbf71988c5c35a68d4a96cb4559c3789f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8750785037e2d157c527efcd31e9d51e2cfdc6a236508b87526f0caa8dad8e06
87ca6b47a6b9474223f530e7b8ea424392eb664d0dd417d61c31da449a5f5c4f
882447805fc1c7805ad98684a4698c4b3ae5e8932261c609f7cdd0834275d72c
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
895f492be4e7fcbe0f12090af4097a95d96b07157baacd9d8011c0a24e4dc947
8b4fb78c5e5599a29f86d20a29d4f69e3ed0654547b1a595cf038ee0553b58d2
8b7be87db71855fe47b30e1a60953e25a0e6a832e4ff3fefa682cf74d9e66cf0
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
914ae362937120d900bb5c5d95c70f3957fa2270c308925e4a72ad56446911cb
93fa8b2f6e13b1ac02946cf42cebafaa637e07feb93b926eace76fd5128df564
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
9732077979c7e132e29da395c2788f43f6dd4ab3020b0c0c539744be21339507
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b7b5d56054f5bab6ea5dfd9472ceb900f406a8a35a3df5b17b606521a411a35
9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635
9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acbe6770b0fc8b621a9d4f7068b241fb403fe999ea33270931ee59ec4cfdf3f1
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
acee3070009a7b1536809adad197b03f8bc72dd33c21310b6a3f945c6ba62142
b0217d36bbfe3a223ab1d527de0ff899f338b848e81fd377bc02d59225d9dddb
b0e6c1c112eda28bd4787e19ce4920424990b564c0fb3b828ec605d91ba4813e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b20e2ee5eec27ca22f8b91f4357f0c52a27270a57f1ab1247bcdd4e42d4aa0a3
b70c36674f1298febe27d175904d872013535e9b0e20136b5dd86bb51c2729e0
b8d7a4d31c11bae41ee6b5e8a3066b55b3d8b1bb511f4b6aaf377ea39a766f5f
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c
b91353c2afda91b4cc980d1b673530b4a7dab4f4f4c5d0b6c27b69fb8da44273
b9f7831c4fced894a1530c3eee8ff966cf8f9c45b635ad681e155f26811d02e7
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
c0269ba28d9ec51948de3000f364e6890e8a369ab832b4deb572415845a39712
c0c801dba101fd68909389cc6e9995efbff381ae06737fe133513209a719ce5a
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c3e093146fad0e34b98a7b0f9e57fbe4ef571abfff63b3af50689b20f8718a41
c68b28f30f95f2786a03a8981ff188ab21c843f792e6e7e2e87b6bffecaff45d
c8de55874475c175335f0c6fc79e975cc9325630e3641389c18ae7ae5ab9a981
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
ca7362fcc0e9111db58886105f1f991c5090eeed7b08e2892612704f3be1c4c1
ca76057cd670f588df991cb00fb1f230de6cde0d7f19f21743981f12c69ab50a
ce2c0959ff3bc3a2b651211c4dfe4506837be5aa5065a27633aaed481f62d7fb
cea918e6af14ac3645e0e33b30cb802820aed3e549defbd618be220c31546625
cef5e7a8bbafdc0187cc3bd50db0417a3ed578deec09d93fe306bddf30a9ba43
d1c6032b67262b3855f2ae2702f0497cf50f3caf6ce5211641f1756ee3a4332b
d217d238f3f2648014fb12906dca5366954ffa6256d160726190d9e0e9c8376a
d71c2ea9add8eb303ecb969dbb50752c85994205fb9b1341dd518c84e2351194
d862322f40f2d63eca24e2e6188d0a164bf431db27369bedebb31c357985f7f9
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0b6d26489191155d30162f050cf2a964afb8cf054e3f59e7f710942a9a12293
e1e4797eacb227503cef66a6fbd3d16197aacdcfb52b915c9dd5de35d20973ad
e337e8f194891a68d03771e8def8c847b627f1bb4fd742941c62c8450ca74216
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec
e486f52416e75722cc9aa42050581d654bba28921f67acf3830edae73f43bd71
e7e2024764e94bff400b354a7cb714ab75f1b9fd4b3fb09de18dca2d6c2e56a5
e9b3c1ef5622bc620a5c1d364aa9fbec2c9d6230bb5f6ab825825db09dd71f6a
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b
f0e3f836ef5ac9ca55829221dae7ca2d70050a37ce5e9dd4697d1076a1f0ea6a
f12e00e6750c744bb34c0b007ef96948e24c6dcf77a34c78c0c4f1263c81ebdd
f156ae940f7e272f1319e3a835871f632bc4275105f4882685a3435d7ed4e3fb
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f6ed28e5e26ebba4c6c19329aea432fba0c64c0f9fbfb321d4105072d2541363
f72897665fa11d91ed461bb1bcfb0426fa50c41e239aeca001789f5739daa238
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
fa176af3695a7e918096d7d71a501167980482180f48dc0e4515855901b42969
fa8c32e4cf3d3e6a515ed02bcb7c24c87a1371ff8b888ca12332e4da8e4c5e65
fa8d00de4d9acf49fccb202f273ba09102e673a8d46bdb520d6bc9b5e740cbcd
fab816e037c0f67ab424c67234af03471c66a13357d6e187ecb238a2eac62a04
fc00bf13873bd873249c9ca97bff43babaffe479592749671db810c34b9f5121
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a