www.threatfabric.com Open in urlscan Pro
2606:2c40::c73c:6702 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Submission: On August 08 via api (August 8th 2024, 2:09:06 am UTC) from TR — Scanned from DE

Summary HTTP 66 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 20 IPs in 2 countries across 20 domains to perform 66 HTTP transactions. The main IP is 2606:2c40::c73c:6702, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.threatfabric.com.
TLS certificate: Issued by WE1 on July 8th 2024. Valid for: 3 months.

This is the only time www.threatfabric.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	2606:2c40::c7... 2606:2c40::c73c:6702	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
6	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:593e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:ad5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8cd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:10::210:a9a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:df98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6812:17b7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:6bfe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2620:1ec:50::12 2620:1ec:50::12	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2606:4700::68... 2606:4700::6813:afbc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:e072	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
66	20

28 2606:2c40::c73c:6702 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.threatfabric.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:593e (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:ad5b (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8cd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:10::210:a9a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:df98 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:17b7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6bfe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:50::12 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:afbc (United States)

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e072 (United States)

ASN13335 (CLOUDFLARENET, US)

threatfabric-6701575.hs-sites.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	threatfabric.com www.threatfabric.com	2 MB
6	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	65 KB
4	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 5067	28 KB
4	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 10634 js.hubspot.com — Cisco Umbrella Rank: 8139 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 8074 track.hubspot.com — Cisco Umbrella Rank: 5359	28 KB
3	linkedin.com platform.linkedin.com Failed px.ads.linkedin.com — Cisco Umbrella Rank: 669 Failed px4.ads.linkedin.com — Cisco Umbrella Rank: 7330	2 KB
2	gstatic.com fonts.gstatic.com	46 KB
2	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 8524	1 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 9601 forms.hscollectedforms.net — Cisco Umbrella Rank: 9837	25 KB
2	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 20878	4 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3123
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	865 B
1	hs-sites.com threatfabric-6701575.hs-sites.com
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 5135	25 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 7189	4 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1884	14 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 5414	1 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 12087	5 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	94 KB
0	twitter.com Failed platform.twitter.com Failed
0	facebook.net Failed connect.facebook.net Failed
66	20

	Domain	Requested by
28	www.threatfabric.com	www.threatfabric.com
6	cdnjs.cloudflare.com	www.threatfabric.com
4	js.hs-banner.com	js.hs-scripts.com js.hs-banner.com
2	fonts.gstatic.com	fonts.googleapis.com
2	perf-na1.hsforms.com	www.threatfabric.com
2	px.ads.linkedin.com	snap.licdn.com www.threatfabric.com
2	cdn2.hubspot.net	www.threatfabric.com
1	track.hubspot.com
1	region1.google-analytics.com	www.googletagmanager.com
1	fonts.googleapis.com	js.hs-banner.com
1	threatfabric-6701575.hs-sites.com	js.hubspot.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	px4.ads.linkedin.com	www.threatfabric.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	app.hubspot.com	www.threatfabric.com
1	snap.licdn.com	www.threatfabric.com
1	js.hs-scripts.com	www.threatfabric.com
1	static.hsappstatic.net	www.threatfabric.com
1	www.googletagmanager.com	www.threatfabric.com
0	platform.twitter.com Failed	www.threatfabric.com
0	connect.facebook.net Failed	www.threatfabric.com
0	platform.linkedin.com Failed	www.threatfabric.com
66	26

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
twitter.com

Subject Issuer	Validity	Valid
www.threatfabric.com WE1	`2024-07-08` - `2024-10-06`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2024-03-06` - `2024-12-31`	10 months	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
hsappstatic.net E5	`2024-07-06` - `2024-10-04`	3 months	crt.sh
hs-scripts.com WE1	`2024-07-29` - `2024-10-27`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hsadspixel.net E6	`2024-06-14` - `2024-09-12`	3 months	crt.sh
hs-banner.com WE1	`2024-07-27` - `2024-10-25`	3 months	crt.sh
hs-analytics.net WE1	`2024-06-11` - `2024-09-09`	3 months	crt.sh
hscollectedforms.net WE1	`2024-07-25` - `2024-10-23`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-07-01` - `2025-01-01`	6 months	crt.sh
hsforms.com WE1	`2024-06-14` - `2024-09-12`	3 months	crt.sh
hs-sites.com Cloudflare Inc ECC CA-3	`2024-03-10` - `2024-12-31`	10 months	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Frame ID: AF1E64673252F1938F56B76FE1D3A0C7
Requests: 64 HTTP requests in this frame

Frame: https://threatfabric-6701575.hs-sites.com/hs-web-interactive-6701575-139494617102
Frame ID: E73837FDB262D4EC45A09F79031B6AF8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chameleon is now targeting employees: Masquerading as a CRM app

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

66
Requests

91 %
HTTPS

100 %
IPv6

20
Domains

26
Subdomains

20
IPs

2
Countries

2153 kB
Transfer

3419 kB
Size

10
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/company/threatfabric
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/threatfabric
Title: Twitter

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&e_ipv6=AQJvlDm9Eg5PJgAAAZEvvyaJLnaBMhfugv-CD5S2qbF1GiiTDr5XpVJTT-Qq0Hqa7KepbGdvN7uYNqQut0aR99mtNw8lNw

66 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request chameleon-is-now-targeting-employees-masquerading-as-crm-app Show response
www.threatfabric.com/blogs/ 40 KB
13 KB 473ms
273ms Document
text/html 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff63efd694d95b007183d6eacdbde18bea3d4f4c6cefb594e038d2a1efe209a2

Security Headers

Name

Value

Content-Security-Policy

default-src 'self' static.hsappstatic.net; script-src 'self' 'unsafe-inline' *.hubspot.com cdnjs.cloudflare.com *.hubspot.net *.hs-scripts.com *.hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net *.hs-banner.com *.hs-analytics.net *.hsadspixel.net js.hscta.net *.hscollectedforms.net *.hsleadflows.net *.hsforms.com *.hsforms.net feedback.hubapi.com *.usemessages.com snap.licdn.com *.doubleclick.net; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com *.hubspot.net static.hsappstatic.net fonts.googleapis.com; img-src 'self' data: *.hubspot.com *.hubspot.net static.hsappstatic.net *.hsforms.com *.hsforms.net js.hscta.net *.linkedin.com www.google.com maps.gstatic.com maps.googleapis.com; font-src 'self' cdnjs.cloudflare.com *.hs-banner.com fonts.gstatic.com; connect-src 'self' *.hubspot.com *.hubapi.com *.hs-banner.com *.hscollectedforms.net *.hsforms.com js.hscta.net *.google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net; child-src 'self' *.hsforms.com; frame-src 'self' *.hubspot.com *.hubspot.net *.hs-sites.com *.hsforms.com *.hsforms.net play.hubspotvideo.com www.google.com www.youtube.com; frame-ancestors 'self'; upgrade-insecure-requests

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-ray: 8afbf63e8a0a96e5-AMS
content-encoding: br
content-security-policy: default-src 'self' static.hsappstatic.net; script-src 'self' 'unsafe-inline' *.hubspot.com cdnjs.cloudflare.com *.hubspot.net *.hs-scripts.com *.hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net *.hs-banner.com *.hs-analytics.net *.hsadspixel.net js.hscta.net *.hscollectedforms.net *.hsleadflows.net *.hsforms.com *.hsforms.net feedback.hubapi.com *.usemessages.com snap.licdn.com *.doubleclick.net; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com *.hubspot.net static.hsappstatic.net fonts.googleapis.com; img-src 'self' data: *.hubspot.com *.hubspot.net static.hsappstatic.net *.hsforms.com *.hsforms.net js.hscta.net *.linkedin.com www.google.com maps.gstatic.com maps.googleapis.com; font-src 'self' cdnjs.cloudflare.com *.hs-banner.com fonts.gstatic.com; connect-src 'self' *.hubspot.com *.hubapi.com *.hs-banner.com *.hscollectedforms.net *.hsforms.com js.hscta.net *.google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net; child-src 'self' *.hsforms.com; frame-src 'self' *.hubspot.com *.hubspot.net *.hs-sites.com *.hsforms.com *.hsforms.net play.hubspotvideo.com www.google.com www.youtube.com; frame-ancestors 'self'; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Thu, 08 Aug 2024 02:09:01 GMT
edge-cache-tag: CT-103904753728,CT-104229759503,CT-122018350512,CT-174294865261,CG-101307487134,CG-6701575,P-6701575,CW-101038360946,CW-101039839309,CW-102233451816,CW-102407694414,E-100565705870,E-100565738928,E-100565906251,E-100565938482,E-100565944445,E-100566507657,E-101038360928,E-101040014386,E-101040140217,E-101294760764,E-101294760784,E-101312928029,MENU-101041626940,MENU-110583778143,PGS-ALL,SW-2,B-101307487134,GC-101041468817,GC-101042470934,GC-101758895261,GC-101962663308,TS-101040118157
etag: W/"401a0cf761970c5a7cfc2ca2ed0eced6"
last-modified: Wed, 07 Aug 2024 00:17:40 GMT
link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jw4yla%2BvmMzt5%2B6yz6rawosDUwTpuKyTA3cJog6UTfDM83WwjokAdhfv42IiV9wsne08VcYL7uovOrOZEswWA0TLClq4KbVXDq2n62FTPF1%2B12QrKl5h%2BH8QXNnltGDGBdDKrQdAb6y77LoBrFifpYAy"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation-rules?url=www.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-hs-cache-config: BrowserCache-5s-EdgeCache-180s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: HIT
x-hs-content-id: 174294865261
x-hs-hub-id: 6701575
x-hs-prerendered: two-phase;Wed, 07 Aug 2024 00:17:39 GMT

GET
H3 204 speculation-rules
www.threatfabric.com/cdn-cgi/ 0
412 B 67ms
67ms Other
application/speculationrules+json 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatfabric.com/cdn-cgi/speculation-rules?url=www.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9bIiZopE%2B3ooExplqEVjVpIWX4ywklRLb40z%2B5oXcYggkgxOK3oKhVpr%2Bda4%2F4WH8mtPIK34qVnzkpmUxc7tLf7x4hFvwf3LadYay79iuCOyFp3sIpvCIrIMsb4FegWq62H9aoQ1CKCSXkv9AsBdtIm"}],"group":"cf-nel","max_age":604800}
content-type: application/speculationrules+json
cf-ray: 8afbf6404b5996e5-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 project.js Show response
www.threatfabric.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 52ms
52ms Script
application/javascript 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
via: 1.1 9adf50a068a92adaab58cf6a21118640.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 11866543
x-amz-cf-pop: AMS58-P5
x-amz-server-side-encryption: AES256
content-security-policy: upgrade-insecure-requests
x-cache: Hit from cloudfront
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
server: cloudflare
etag: W/"61ca66de658cab9587e4636894680d5d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EJq5%2BoCx2JxCk8XchqY8M1x5cy2jlCCvFMJI8qDuxNeL6CgssawDymIA9jTfqYRirnEKU%2FpFSPYLrQf1TYh9bSi05KFg8XR2n%2Fr6omHyWYOITuoNcrAIh2eiY5NNVPqI%2FpYxbthCeFb%2Fns5LXlf0JgAr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8afbf6404b5a96e5-AMS
x-amz-cf-id: wpV40ddnJLVAvF4asKmU2ms3HdkihaaK5YkoTdbjgNvnKFU_g51jAQ==
expires: Fri, 08 Aug 2025 02:09:01 GMT

GET
H3 200 100.woff2
www.threatfabric.com/_hcms/googlefonts/Kanit/ 25 KB
26 KB 67ms
66ms Font
font/woff2 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/_hcms/googlefonts/Kanit/100.woff2

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa7fe4fd0aef1b94a3910f43b99060d1fcf2b12302726c4f52146ca1f613e516

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 cc03ea6a31b592e93e84115778cdc494.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3597
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-amz-request-id: VF8WBASC5G2EYDYM
x-cache: RefreshHit from cloudfront
x-amz-version-id: Ex_PSmZfVx9KiCmfDr58lb1Qor1iW7rw
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
alt-svc: h3=":443"; ma=86400
content-length: 25596
x-amz-id-2: FKmVEnlpuJlYhZC4WDRcn+ThKp9ictrpqpZHVy4MuOOp6ugAGw+2nSjpXuA8DrxCCxuUSwyvC8SCLf17rI3fDagMHuij9LON
last-modified: Tue, 12 Sep 2023 20:06:52 GMT
server: cloudflare
etag: "bd6ef5dfe3fb409deb99fd2dfa07649a"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jiyiNJvJ%2Fi9BGq9xkijeSOC0wE%2FOdIeOHhlYTuhF%2BroiU9u%2BN%2FPUPnhg72%2FJPzDKw8gHbnyLsfJfNfqzhj1D%2BhT%2FP3Mx%2BBKaJFxSgTfB4fAyWMouA1mj6q%2Bz%2BkE0LsDZL%2BdrJ6Io2BSNRHYGkjVGjQhs"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8afbf6404b5d96e5-AMS
x-amz-cf-id: GP5t3P1I6qCbI4Om5alOtnuz3tA77s7i5tqeYY3v1gsCuEAx55tnYQ==
expires: Thu, 22 Aug 2024 02:09:01 GMT

GET
H3 200 regular.woff2
www.threatfabric.com/_hcms/googlefonts/Kanit/ 26 KB
27 KB 54ms
52ms Font
font/woff2 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/_hcms/googlefonts/Kanit/regular.woff2

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b023c3b26ca69356ad0aa6b6296d5e6a337ec10ca1f8275483437202a03c381c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 03335b4388aac682bcebdd7893781376.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3597
x-amz-cf-pop: AMS1-P3
x-amz-server-side-encryption: AES256
x-amz-request-id: BYFF51QWFXCDEGF5
x-cache: RefreshHit from cloudfront
x-amz-version-id: R8IBymNhr0oWzfN7i1miwZxu391_6F8B
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
alt-svc: h3=":443"; ma=86400
content-length: 26352
x-amz-id-2: DcKM7PYD2oscAVOzBC201bySr5QBukSvUWPtuwPaMCZYqZfC6lMXFZqjsJapYlnnSqOJbfGUtsM=
last-modified: Tue, 12 Sep 2023 20:06:55 GMT
server: cloudflare
etag: "d4d741d6401097b23f04835fd935ddb4"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jBU5Gi9uf8jE3NVKzahCHDQ0kO%2F903REXvfR6AdvuRmYFCTZlIAOFJgDooPvduMfLWtLhWAgMIZGo3%2F%2BZLzFmSfe0GNitZIiNMPr2LaeMzuRRGdsGdMA6pSQOB0DSn1JuPKGlvxQV0CNwvPUXBc0cqua"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8afbf6404b6996e5-AMS
x-amz-cf-id: CrvkzIKFe8TLnRLc1dVAiUjCP51V72k5octyDRpTMyCMuH-ae05FFw==
expires: Thu, 22 Aug 2024 02:09:01 GMT

GET
H3 200 200.woff2
www.threatfabric.com/_hcms/googlefonts/Kanit/ 26 KB
27 KB 63ms
60ms Font
font/woff2 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/_hcms/googlefonts/Kanit/200.woff2

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0adb227efa2074c6ae2b5e686cf4d1949a6edfc05bd56fa81e34c9a2c69fb50a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 bf5caee39117de5337c47c748b716e80.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3597
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-amz-request-id: V8SQKNXV0J2AWBMW
x-cache: RefreshHit from cloudfront
x-amz-version-id: .Y4_sica4_7w7dZrWB8zUo33LkbHGzIv
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
alt-svc: h3=":443"; ma=86400
content-length: 26228
x-amz-id-2: j4Ns8h+cheuddP6ie+uA3N50FJ+NmX1YJh/3YkHIQ4XpjoKi1dgreoVUy5b3HRtPSwfqPsdbows=
last-modified: Tue, 12 Sep 2023 20:07:00 GMT
server: cloudflare
etag: "a3acdea9b09d1ffdf16868a322d89c6c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OHE2HAPitm64PQ0udbqTKx6dzaqIb6Jk5eo%2FvUSfEGgN1FSnU1HOyv3cm%2BCYJQCupFrnHpPXQVDlbioA6If56W5Gg2BajDE5xrfMfWo3vIEAUd6CfuRnhw%2FBo%2BcdmW1bUbfQl1THViH4l8A75gDGoQBu"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8afbf6404b6b96e5-AMS
x-amz-cf-id: DyGDAzJjxsitw1IDLXpzP4hWF43Ha5m9XaqEm2u2LhkuhuauCZAOmg==
expires: Thu, 22 Aug 2024 02:09:01 GMT

GET
H3 200 main.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565938482/1712566991562/Threatfabric_Hatch/css/ 474 KB
97 KB 82ms
79ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565938482/1712566991562/Threatfabric_Hatch/css/main.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c564955dad803a6139bc52a7d05b9fcceeec494e5aced6e9db08d20d8ff076ee

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 238
x-amz-request-id: MBJQJTWQTVFEXMCQ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"859ddc6bb854f252af8367f7f2788fef"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566993905
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-amz-version-id: uV201nZDhB1C0jUSHWbSv3F_kObyKinu
x-cache: Miss from cloudfront
x-hubspot-correlation-id: bed7a0a4-bf65-440d-900c-abaf74cefdc8
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 254
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Jlo/o5k5T8mrhgRsd71C6luaYTcO+yMarggw4wbkSCj76mwaehRXN2u9dCM0i2K3HWJ+vh7b2e0=
x-evy-trace-route-configuration: listener_https/all
x-request-id: bed7a0a4-bf65-440d-900c-abaf74cefdc8
last-modified: Mon, 08 Apr 2024 09:03:14 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BNnikVaRzjqg8u0iefJgpXOv7w%2BaQboXNawh8nV9MtYciVeAoKrjoNiDTi%2FAERsx9Fhx6ON2HGqRDJ6iBSyJrwpYqK%2FPveBFezvRuLUXUXs7YtlEwMs2tdmhj9ihW7dRyI131x7KktFiQiw2daM33Bzw"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-lrfms
access-control-allow-credentials: false
cf-ray: 8afbf6404b6c96e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: p9sR2tYUBTOSyAhF3LO2lx-60L-I4xHTJJnn6eI92G0cEO60V-Tx6A==

GET
H3 200 child.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/ 18 KB
6 KB 53ms
50ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/child.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e9c6e361ad47dcbdc817cde52918b29e424ed462fbbcef27ae9d2c826e7ee63

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 3598
x-amz-request-id: MBJZPD6NPA05W5HB
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"5a5a650f203fc94d0365fea983d98822"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1714390879936
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
via: 1.1 9b097dfab92228268a37145aac5629c0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-amz-version-id: 9MNBXojoOMXTDBn_r9zZsB4hER1sLFIj
x-cache: Miss from cloudfront
x-hubspot-correlation-id: 1d980dac-2871-4f06-b040-4a446128ad18
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 239
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 3jDxB+CIC5BQ49ZvNq6AM38q1iDMrUfNa0vrx/j4aE0evdCxv9UJjB6+VK3NW53odE4aq5NUGjzCECZx0nb4/xmiNvUaXO2l6/En3FjL87c=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1d980dac-2871-4f06-b040-4a446128ad18
last-modified: Mon, 29 Apr 2024 11:41:20 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVh9jWK2srbVGYUxTmvIH9%2BclBX25%2B01EXjI2mYx0uX1eLkxGcvf6u163KT7T7IOUYtEw7llBLb6U5F3QV%2BBJEHoDfcvvJSmgz7Hfs1cGu87UxA%2F6bMl7NqVYW0uB54jvDeQ9NNsEcqpuQqKEz3ofrDw"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-tjdnr
access-control-allow-credentials: false
cf-ray: 8afbf6404b6d96e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: wfnUr6vb0neFJLcPqGBGBEri1P0Edb02SAvgiNfHv0MMm7jj4cT-HA==

GET
H3 200 icons.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760764/1688634016207/Threatfabric_Hatch/css/ 8 KB
4 KB 105ms
102ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760764/1688634016207/Threatfabric_Hatch/css/icons.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b754a50214c3af13ad5b80267b36a52a379030f4cdf28ea62bdc23121fb63963

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 3598
x-amz-request-id: MBJMV289TZR0X062
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"f485b62b545a7fcece25c8883be79caa"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634016207
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
via: 1.1 85fc1201a1918facbeb30836e7391660.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-amz-version-id: 5nj8DyG_fzY9UD_XVa9rI2VVLKA_WOmB
x-cache: Miss from cloudfront
x-hubspot-correlation-id: 21ac5106-1328-426d-83bf-e0df985083e5
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 183
alt-svc: h3=":443"; ma=86400
x-amz-id-2: nt6lqRFbpoaxsx6Z9y0BiUQP9IQSqeOqhgbC/c4ip871TLSXiYWBGWkHS3FGFFUPCHSaiUWCPpQ=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 21ac5106-1328-426d-83bf-e0df985083e5
last-modified: Thu, 06 Jul 2023 09:00:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fw85i2jl%2B5M4OquzHrfdHFeeC%2FbdS0dGZ6rRcQfRZFTc7mRZvHrqtFbYacZXSxjX7KXDlaAOrPT12fPOXsWoASYAKNHpewsdiapzYpo5FiiZYO%2FQQorvmyjS9Z6Epf2SjRVGUbTfNzoKEbvJQmV1M97s"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-tjdnr
access-control-allow-credentials: false
cf-ray: 8afbf6404b7096e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: vnJWcWTxTa5rWYRhwFGmisYXe5g0XFOl8yMkTFHu_ozJy8t5Z7Htog==

GET
H3 200 nucleo.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760784/1688634017698/Threatfabric_Hatch/css/ 2 KB
2 KB 105ms
102ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101294760784/1688634017698/Threatfabric_Hatch/css/nucleo.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

74c17452683150ad0f623fdd9a849ba85d73fb9d221cebe9aa11db52969dbe23

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: gzip
age: 238
x-amz-request-id: MBJGR48DPTHAK164
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"49397c87250109646a57314c716d8517"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634018325
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-amz-version-id: izNRL5rIQmPgjsTIc9ETzUXSIAYDVuDR
x-cache: Miss from cloudfront
x-hubspot-correlation-id: cfef1b44-e0f5-4efd-8b6b-6f2db14eb5d1
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 188
alt-svc: h3=":443"; ma=86400
x-amz-id-2: JYm49Idb81ggkrJX9vXd7oaF4O3NQnds10LuZmvspvZeZOPout9PQChX3hOBwXP8nx2ZApsH4D0=
x-evy-trace-route-configuration: listener_https/all
x-request-id: cfef1b44-e0f5-4efd-8b6b-6f2db14eb5d1
last-modified: Thu, 06 Jul 2023 09:00:19 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pDoJ%2FjUhalD8Ph%2B1kiipIBJHPFGzKkE%2Ft5e4FQ7fQ7COzndxFXlU8ZqMO7Gd8e2scMcdHHyLdjuN8yiqrYVAaASlYTqpF6i8sFxmmP8Q1Ru%2F%2BZqr3S5MLMGPs5Bb7UeuRmNPPX99%2FdC9YlZhqWAbhZkd"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-tjdnr
access-control-allow-credentials: false
cf-ray: 8afbf6404b7296e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: CCFnxsH5bXQ5RNQVQGLIrdZ2dVISPcyUQjgLVUBa-8Va8FokFdBTxA==

GET
H3 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/ 58 KB
11 KB 64ms
44ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/all.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 459785
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10491
last-modified: Mon, 05 Oct 2020 17:43:59 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f7b5b5f-e7d0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RflclkVmfhzSAOf73XB%2FhlfFdvXRJFpU%2Br1awsZNlQuW7qmtiKciXr%2FkhsMoPXL3xUYSQXNhboz%2FJOm51RVwm4E682UBcJgcQJ7VgjyoR5NRud3hlGFePYxELOWoSZFwZqwszJSRzq98Ll1p6EMDEHEY"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8afbf6406ce00a68-AMS
expires: Tue, 29 Jul 2025 02:09:01 GMT

GET
H3 200 module_101038360946_Header.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101038360946/1688634802882/ 365 B
2 KB 105ms
103ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101038360946/1688634802882/module_101038360946_Header.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5172f440714da51e243a13e0f93911405618326b2013313b682caa428c47e6ef

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3598
x-amz-request-id: T69K5HFKYPM1KM0J
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"9256add48c317a196c6723f7f46739fd"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634802882
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 dd169cfdbbafbb3da513bede6bc6640e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: gVyaXIU3JxB7cR9Hx9mqhXufUagRPpyd
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: a469cac8-d607-4034-aa13-4d11174c7171
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 152
alt-svc: h3=":443"; ma=86400
x-amz-id-2: eyKoLkEmqVvhBv7FhUm3Qn6v3LbMXKcCE6lJsxvZLCcSylJoxm08feGiSd44mPbm5gchhLQ3420=
x-evy-trace-route-configuration: listener_https/all
x-request-id: a469cac8-d607-4034-aa13-4d11174c7171
last-modified: Thu, 06 Jul 2023 09:13:23 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5n9vGeaxE5l0Z7w2Rn6RKrpSgfuYVffaCVwPkTFS%2FjTvAeRzqM19SIiMOOT%2B%2Bx0L9yqbCwutxuPDKGKUynb5fUuT0gppsrly%2BWAPlnPclfwS6fBm9hnV%2BqRmWv%2FyVWj9w5L4lhwWd0pdrMdKeTmfJij0"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-jn7vt
access-control-allow-credentials: false
cf-ray: 8afbf6404b7496e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: uYvqm3-0CwdGsxRqEPLXXZxgXwPv2insym3Lqf82twW1-2qLmGbdtg==

GET
H3 200 module_-2712622_Site_Search_Input.min.css
cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869177377/ 612 B
1 KB 49ms
30ms Stylesheet
text/css 2606:4700::6812:593e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869177377/module_-2712622_Site_Search_Input.min.css
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:593e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 401925a1114f7003121630392768d35516be54a4028f01024528aeae99a45a56

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
age: 213668
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"c708989561e0cdbfcf996d1b7f47482c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1722869177377
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 526081b8-9088-4418-94c6-fb414f0fe114
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 155
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 526081b8-9088-4418-94c6-fb414f0fe114
last-modified: Mon, 05 Aug 2024 14:46:18 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qClCZkkzuTPbCCVeydyfi%2FNT3%2BxUk5LNBcE5iM5tRcrRiCL2jwKr%2FrttbV%2BCF8nErIneZtKE6b5Qnfj4bDfH9bAhuZm5IG3YodUgiKc%2BxUzbj4BTBsM4nDe9UrSHgN3AYoWpVOLMgVC%2BW0MyUe4%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-dwjx9
cf-ray: 8afbf6406ed20b37-AMS

GET
H3 200 module_102233451816_Blog_Post_01_-_Banner.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/102233451816/1694502536285/ 208 B
2 KB 105ms
103ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/102233451816/1694502536285/module_102233451816_Blog_Post_01_-_Banner.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6685b4f71edb4ae81b8a710e36f8c794c3e731feeb17614e476daf056b06a824

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3598
x-amz-request-id: MBJNCDWJ168XM0A7
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"835a1aea3731b5d0aa01d0cad90f4c2f"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1694502536285
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ssRnpRBke62diMBB.QBnNR1bBVg.nduX
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: ce38a1b1-3ad9-4ab6-9a8c-82fbddaa3c06
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 186
alt-svc: h3=":443"; ma=86400
x-amz-id-2: z5+O+CG9XHBd+nX5AhAJsLQ2BkkoDBq9izOf1T/0w1lY5wJCEu2/Atgh/yLaQNR4U94sqTFbL1KsxUaPewpdwcArOVJYxBy8EMSST2NkZkI=
x-evy-trace-route-configuration: listener_https/all
x-request-id: ce38a1b1-3ad9-4ab6-9a8c-82fbddaa3c06
last-modified: Tue, 12 Sep 2023 07:08:57 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lfp9mPvUy8LaBQlbq3x9dshbP6bfX5jLXW9JQLxvGDnkKYvbnfBQNNwwB79t7gwzoOCDr2CkaUN1m1QHnKk1DzZC6BZsteVDvqEDrl6wT4f9w%2B%2BqmLdLNwwvWXFih5hmkR4kfLrU%2FmhmXlooZzqgrfQS"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-lrfms
access-control-allow-credentials: false
cf-ray: 8afbf6404b7596e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: v8Sna9HqgN5GlOTeiJ_QemFBA38zw8toQeFzcyF4iFFIy5J5CR-fcA==

GET
H3 200 module_102407694414_Blog_Post_01_-_CTA.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/1718609428269/ 749 B
2 KB 52ms
50ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/1718609428269/module_102407694414_Blog_Post_01_-_CTA.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a924c55af6e42515871fdd850703bea91aedd280d30febc3ddc9f674df234785

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3598
x-amz-request-id: 08PTX44KA0PZ2H6F
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"e2815258c7a6f2ee41cbfe804e58e066"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1718609428269
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 be4fef3f6c1b2c76e0341ff49a27ce40.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: TqETGXjPmLIPWPl8IqOMcPpc8lXb7CNv
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: d9c7f761-5351-49eb-ae6f-c36a53c6e8bb
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 172
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 88q6TMOL/swA4ulids5YckyKbZUvv6RVqiNzi8tJf83wK4ZhXEesDe8H6WqhQXZ1tnsDjMbCSo0=
x-evy-trace-route-configuration: listener_https/all
x-request-id: d9c7f761-5351-49eb-ae6f-c36a53c6e8bb
last-modified: Mon, 17 Jun 2024 07:30:29 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XS40O0Ou1ae%2FD17ZmehdO1E6a5pGeVuZlxPYfzl1MQKFMpuPJA4EXkv84nZpXPuUp3n8Qfa78bS3qKm5NjKzDsbbv1ZAX2nc3U1oDiF%2BJ6%2Fp56XoGqhVoD6igRAIApq8WXg6pC%2BTiUVo3dvtl1dfK2sl"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-jn7vt
access-control-allow-credentials: false
cf-ray: 8afbf6404b7796e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: GyDXmiLLqYXlrUGPp2wQ6RzFSupARgkU7Q-n8kze3Ut2LMCHFYCIYQ==

GET
H3 200 prism.min.css
cdnjs.cloudflare.com/ajax/libs/prism/1.23.0/themes/ 2 KB
1 KB 62ms
44ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/prism/1.23.0/themes/prism.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

928e23e6b9fcef82c5f1d1f05b6f7fc5a6e187c60195e59fbf16fc9d071ee057

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1246853
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 563
last-modified: Thu, 31 Dec 2020 20:37:58 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fee36a6-6fd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FywRgBaAM2Gqe5fDC2JNjPF5ZANSYYwXSC6mrFcwg8FjZLltKW4F41v07ZSpJw1RRFybXb%2F3t970MkvezpVJoPi4EC%2FmQdhGl3Rbj8q4M%2FeouLHgt7LUb0oeS4AoWni3CQML0gHCdW%2FoAkUHZF5Z3yCa"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8afbf6406cdc0a68-AMS
expires: Tue, 29 Jul 2025 02:09:01 GMT

GET
H3 200 module_101039839309_Footer.min.css
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101039839309/1688634802817/ 542 B
2 KB 104ms
103ms Stylesheet
text/css 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/module_assets/101039839309/1688634802817/module_101039839309_Footer.min.css

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d65652e4a1175891a46374d16ec569329b2e667eedb5770ce7ce193fd8fd41a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3598
x-amz-request-id: T69PZVWPWA613FQV
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"ed0772c6a57504bedc0b6dd9703ab3f1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1688634802817
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: aEtuO57JBQ7Fe7bp8NQY6TbBJpxyVa2Z
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 73dadd73-8c53-495e-b73c-67ecf5026bbc
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 353
alt-svc: h3=":443"; ma=86400
x-amz-id-2: PlHOoc+eChV5/2sgY+6XDIDYs43qi9c62i+P02xDdLbfUP+rNzgfiWSwKRq99tyzzReaRwQrTdE=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 73dadd73-8c53-495e-b73c-67ecf5026bbc
last-modified: Thu, 06 Jul 2023 09:13:23 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9w66OHVsnWMWopf3tQ0qavK6u2fyWWp1MLklF6d75HnZzVEC30XSrdzTo%2BLrt%2Fg%2F%2FIA%2FHo0VyjMxxqHPuWePG0hirtOd0Lbg3XdD%2FRkrSbQzvO3Nr77AZaURLJOAurW%2FhPgpW1mFyXe4JT%2BiBItN0xSM"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-ts7f8
access-control-allow-credentials: false
cf-ray: 8afbf6404b7896e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: RWxJX-gGoAuR5kR2Ctrh7J9JuaRNeCmjDXfrGiHiwe_4q2jjpVLfBA==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 270 KB
94 KB 48ms
24ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SZHLN4DST6

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

63156dffa3667d9807dbba2aa8e9c4b2dbcd50a755bf72e0478cf542a533d730

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95798
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 08 Aug 2024 02:09:01 GMT

GET
H3 200 threatfabric-logo-light.svg
www.threatfabric.com/hubfs/Threatfabric/logos/ 3 KB
2 KB 104ms
103ms Image
image/svg+xml 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/logos/threatfabric-logo-light.svg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e082d568fb44df37fa453a514a8e553c889abe144c5c73866c1f020e4ccfbc49

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-101040308776,FD-101040367016,P-6701575,FLS-ALL
age: 182826
x-amz-request-id: 7SVA3TWC94QT3TDM
x-amz-server-side-encryption: AES256
edge-cache-tag: F-101040308776,FD-101040367016,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"8b008611e237cad1162ac34fa0566106"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1675415283131
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 b75b06741e5146585057681bd60737b2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: YCo1pSCjPp8.6ZHhoecaW6WpJqmNwWPZ
x-amz-cf-pop: AMS1-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-101040308776,FD-101040367016,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: eoqkttXALE933yop2WOYx28m9md0sZWYjIIiH0lnTCU89rDNgVkPMs9jB3yp6pHRERfA+0BCJzU=
last-modified: Fri, 03 Feb 2023 09:08:04 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hEnpFCPfPPGlltiwhs%2BDAZrxfOHKSeUlF36PgMB5AxmeOAxC4YqviJxlekMRcmVSQe%2BCZkV1PMo8TVE5xNUzT%2B%2FqqL3wGgisvLviW87tNn90HLIbEZRbi0cttg7ftpKtykH0Zbfvv26rCZG04Bu4qlxo"}],"group":"cf-nel","max_age":604800}
cf-ray: 8afbf6404b7996e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: Aj5aRojh_Nyf2lMGMAKz5xW5jMfmG1FOg9FUXCq0cyB8kduu1-O2jA==

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.971/ 13 KB
5 KB 58ms
25ms Script
application/javascript 2606:4700::6811:ad5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.971/embed.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ad5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98dfeb1d061e8788b320a130a84723813efed0b2518921f30b40cc8a09bf8ecf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
x-amz-version-id: 1gm1MaaLzWiIBc2FerIVtLdckhSMSaY7
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 06cdb267b93af0cbfcd6cc564136784a.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: AMS58-P5
age: 635903
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 Jun 2024 15:05:39 GMT
server: cloudflare
etag: W/"26c40482b55a607cd44486a2958741d4"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BLAXbtUgF3wWZOXUsJtbHOXvJWosskeoXWEnBkdvw3cgUEYIOMdTEfgl1vlhT6FWksS0vys3%2BZPEwQ%2BI0c%2BTIosCA7nRB5%2FZtpZ2t1d5TNT4nZeDjOZaCW4P7hd5a4Z7VHHZ69yPxhquq66Ni2uX4n3t7l0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8afbf6414b1e6684-AMS
x-amz-cf-id: Jv6QeL5RyhGpE7inAlsnseUUIh-gRTOQaFiKEoBSVLeHxSEEVC393w==
expires: Fri, 08 Aug 2025 02:09:01 GMT

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ 87 KB
28 KB 35ms
31ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 457529
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27958
last-modified: Mon, 04 May 2020 23:01:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb09ed3-15d84"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2BgvoKIfI8jwwvYZv3oXUNSBEISAqWOwWLDFL%2B204lYaFpcj56YDY9BCB4mLH6SCiPlcWf%2BHjV7eRiPAHkg2BGWsatwgWXkYBqmjiDMYgCbWjxoL10uharDsXfDCLoYFY3wNkITHWpv1ICYMt%2BwXCHeH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8afbf6406cde0a68-AMS
expires: Tue, 29 Jul 2025 02:09:01 GMT

GET
H3 200 jquery-migrate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.1/ 11 KB
4 KB 22ms
22ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.1/jquery-migrate.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89bf8cdea73ce776d6b81d03837bc7f04af5e3946b839a3c0bfbf3094ad3f7be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 457446
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3592
last-modified: Thu, 25 Jun 2020 01:22:57 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5ef3fc71-2b0b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XlbhG5B%2F%2FeIkjWgW7wj3o7kyunkXxwgelCF19ckl37xJBvd%2FMM6J6yYKg8%2BXcFHNoFFE4XOMOyQF%2Fo%2F7ynW5AePGGRb6wL6%2FjhLhZEPt6rrU7YF1tvIEYB3GxcT0Awts4R0IK%2FO24AXgtaROiP8fRqYV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8afbf640bd280a68-AMS
expires: Tue, 29 Jul 2025 02:09:01 GMT

GET
H3 200 plugins.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565705870/1712566990318/Threatfabric_Hatch/js/plugins/ 203 KB
56 KB 45ms
44ms Script
application/javascript 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565705870/1712566990318/Threatfabric_Hatch/js/plugins/plugins.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

42db2b6421ba0667a52a6f929b6f61decd0a6efd16ac1bde0701bcc0e132d4ea

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3598
x-amz-request-id: 51ETDZYGQ2D4GF9K
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"0c0f5074d4f875852639ceb3929df89a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566991454
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: fjOXJuabDfIf8ylKYtupYQJB8ocmEl78
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 04411fe0-2433-4178-8156-d04b7cbed38a
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 208
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1T0XetbZzAIpH2TXyFji0lwNqp+4rNniktRUZeqVjKyR04dtlulRlcobQoWP2MCcLOzqJhEMGSo=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 04411fe0-2433-4178-8156-d04b7cbed38a
last-modified: Mon, 08 Apr 2024 09:03:12 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UFcJWeWHzNTUSvCSg%2FoBbc9Q%2FTqsBLUcrP%2F7PB8K5wei%2BhHqjIjMXYJAjezu1HHf1NQcNsOmFBUg%2FN60It9snx7NqpAzA%2BpsCxjoDK01%2FH1XV3uyaoY3j3D%2BeQG31u45DT89sNsVklBMwxx89cVtx%2FAF"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-jn7vt
access-control-allow-credentials: false
cf-ray: 8afbf6410c1396e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: 8YiL-Am_jd6OEvrnU5pL0Ac_fyfKU7Lgnyljj381LGXYFhc-HPR4fg==

GET
H3 200 main.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565738928/1712566988034/Threatfabric_Hatch/js/ 30 KB
8 KB 59ms
58ms Script
application/javascript 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565738928/1712566988034/Threatfabric_Hatch/js/main.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c917923119f99ca28c29eca25a2a4a9606edd23f26633bab2e212ce053dd5f1c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 238
x-amz-request-id: MBJMZNG1AC5F2KZM
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"0af793e68edebfa90f8e52a942155cc6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566988355
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: 5wOCXUk6GlkhCRHCrKIei1hIBxtJntKl
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: dc541e6d-463c-46b8-b0dd-f415f717ccc7
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 305
alt-svc: h3=":443"; ma=86400
x-amz-id-2: PrvjrZBk9cMiC5xfW8AkAwD8FR50XEuyhldeukCgQs0rnTIKjv2+BYQpcgzZ+dDd2XqjqRiH0liaa7EHrFEmSA==
x-evy-trace-route-configuration: listener_https/all
x-request-id: dc541e6d-463c-46b8-b0dd-f415f717ccc7
last-modified: Mon, 08 Apr 2024 09:03:09 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rVW%2BsVvikpUUChXtM6PMyxBjfRxDKmgwpdeuZPg%2BMQIGw%2FcFhs9LCLj0JDJ1gTO8q7XP3LIOZfUlpSviSBAa5GIkRz%2BsUVYEy2r8e1bA99VzqXf4CagpwXrfk1ziwsLkwlbPh7Ses5r4%2Bv8p0g0B%2FNVb"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-jn7vt
access-control-allow-credentials: false
cf-ray: 8afbf6410c1596e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: knYrIZ-PgmJecrVVs9vNvxapBum5kFTiirFGB9YYm6T_D8_97DWbTg==

GET
H3 200 child.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040014386/1687845070161/Threatfabric_Hatch/ 654 B
2 KB 44ms
44ms Script
application/javascript 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040014386/1687845070161/Threatfabric_Hatch/child.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c16d59010b5c7bc246cc28fa0b991da4aaf6ed332f99940a4d5bd29de1ad43de

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 238
x-amz-request-id: 51ESH787VVCJN5JY
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"6748e45b4b9a78b567cc67c4bbe101c4"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1687845070347
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: tWyHUvyl_PrBUjYVhQfi.cVUEpkzlair
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 3cd3b69a-9ea6-4f10-a30b-465eefc54c57
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 159
alt-svc: h3=":443"; ma=86400
x-amz-id-2: XNmtCBdNNJSUHrxZwcgHeWG67/ASKEDMnAxFevVZ9pAiUbM2Zop1DGnGmehtxFxNmjFV0IwsrTw=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 3cd3b69a-9ea6-4f10-a30b-465eefc54c57
last-modified: Tue, 27 Jun 2023 05:51:11 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XzKRZJ0vYGW3YHzBWdIF1lCMt8HywMpwE2ngPyGWC%2Flac7pBSQtJo2Z51w%2B836V9Yt5cHydJBhMLVQQUiX5jPeNkfJFo7s2wFrZfQetSUF5hqCvlDmyjzm7RNe1DtiM5TtVAVVZuL7EFw%2BvRki1m5NAq"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-x5qbk
access-control-allow-credentials: false
cf-ray: 8afbf640dbce96e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: wRVKyk7ARb5W-66S-GsTZpG-2lUQb_j_kmm5mtg_r2yqP73vJpVpYw==

GET
H3 200 module_-2712622_Site_Search_Input.min.js Show response
cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869176728/ 4 KB
2 KB 35ms
35ms Script
application/javascript 2606:4700::6812:593e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/-1/hub_generated/module_assets/-2712622/1722869176728/module_-2712622_Site_Search_Input.min.js
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:593e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 863886e2347be57cf71d7ed3fc614593e94bbce61858cd8c0761ba7a78d2ace4

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
age: 213668
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"f9134a973469f840bf03f740af92c65f"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1722869176728
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: f17bfdd2-d45b-41eb-b5fe-5937eb7460d0
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 157
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: f17bfdd2-d45b-41eb-b5fe-5937eb7460d0
last-modified: Mon, 05 Aug 2024 14:46:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=orDj8fL317f2wlCK9nvkMtFALzW1qTQLBnXAZdEEOToE4NJMk%2FNBPdpzDe4kkOEo5o7Bb1ZdW6NTb%2FFl5oBuXsyEB3S%2FQzJQjcWrvm8yXzIQ12kRqmLUX5%2FoP5Oo1x%2BZ%2FhBO7V0hwAkn%2F4orfGI%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-dwjx9
cf-ray: 8afbf640feef0b37-AMS

GET
H3 200 blog.min.js Show response
www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565906251/1712566976389/Threatfabric_Hatch/js/ 392 B
2 KB 51ms
50ms Script
application/javascript 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/100565906251/1712566976389/Threatfabric_Hatch/js/blog.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae37720bad220c27736f9097566e8cec3bce2f45d980f509c193f54d6d4aea59

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3598
x-amz-request-id: MBJPQ65NBM7PQMHS
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"192208997eb533dfcb00b8442296edae"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1712566976534
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: pqFrH_U2a9yz9fm669sD7mXdUI5HLuH9
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: bce8aa6d-999b-485e-b215-92f1d6690aa5
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 609
alt-svc: h3=":443"; ma=86400
x-amz-id-2: UBNK44DzmHTRLSnMmgr0VIF4TASst0UONdyMJvfLBu55J75LEdSVygkLLY5xhfqZIloOoBrNU/I=
x-evy-trace-route-configuration: listener_https/all
x-request-id: bce8aa6d-999b-485e-b215-92f1d6690aa5
last-modified: Mon, 08 Apr 2024 09:02:57 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AK9rkpSa5XigEEqKXY5bvWImw%2BDqQKtVn1ZLAMqkegz0WfAcDec1RaOPGVZXEEATvCn7zKmv9vjeH3%2FSxI%2F190jRKfEDXBzuBqz%2BtK7BIS9J7R2QV7BE7yT611uLrmmpLOFbnpDbEDfRrqehnrRFJN7F"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-tjdnr
access-control-allow-credentials: false
cf-ray: 8afbf6410c1096e5-AMS
timing-allow-origin: www.threatfabric.com
x-amz-cf-id: bo0ySDE0iqMTHyOtVSZ5QFj6OoS2EHENllnUFMocULQosCIpEOEA_g==

GET
H3 200 beautify.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.8/ 73 KB
14 KB 24ms
22ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.8/beautify.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d5c291cc9ce12740d42109fbf4384252918103351a98793ffa71f764ea3e4cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 387259
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 14063
last-modified: Tue, 09 Jan 2024 00:54:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "659c8b1c-36ef"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wc1QmAkNQnAFN1AafyvMjDYN%2FEe0rX65j1YtYJqqDs6vEKF9zBZx2Z8JF47ue23szqTdgcaj%2FvBVRq2kExgqh7zQI2t4In%2BW8dou7lvrrpAxMd46ajjkVPfvFZZZZLRgnHHbfWNYy4H67v2NkolQe2I%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8afbf6410d550a68-AMS
expires: Tue, 29 Jul 2025 02:09:01 GMT

GET
H3 200 prism.min.js Show response
cdnjs.cloudflare.com/ajax/libs/prism/1.24.1/ 17 KB
6 KB 25ms
24ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/prism/1.24.1/prism.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc377d0b25d1c78cd2fb2d8c9b3cc8fe12db24bd47084deda1129905ca256099

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 452707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5980
last-modified: Sat, 03 Jul 2021 14:05:42 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "60e06eb6-175c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FNmAOMwjMJZu%2Fkaz6qbmhb8TxPVhO%2BeENIUlUImsfIIB0lfQLmkizhToxmFWZgrRjS%2FHbdk6QIPhem2FudPXTsaz1e6dqkqkmNIv75NJLRNARqWKPiu8dZepxskXQl%2BHWzn092Sw6v7xCXeavBDraJ%2Bi"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8afbf6410d570a68-AMS
expires: Tue, 29 Jul 2025 02:09:01 GMT

GET
H3 200 6701575.js Show response
www.threatfabric.com/hs/scriptloader/ 2 KB
2 KB 321ms
321ms Script
application/javascript 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs/scriptloader/6701575.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2c7b9abc29c9ae0977aba384eea9a1890bd77ee763daa7011dc87d23c1617d1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a0a0bf33-e84e-4bd2-bd40-baa0905fd0db
content-security-policy: upgrade-insecure-requests
x-envoy-upstream-service-time: 5
alt-svc: h3=":443"; ma=86400
content-length: 685
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a0a0bf33-e84e-4bd2-bd40-baa0905fd0db
last-modified: Thu, 08 Aug 2024 02:09:01 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-85b74c4c74-2mdnj
cache-control: public, max-age=90
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WP1gRGidnCUL36cbSU5spJG4zzTaFEIlAsLHJXJ5tQJ1E4oskneBd470sXuoLAiFqSfYNA%2BClC1Vkp3sOvRCiMZSqvzjoW3vQ9HWwBpzaQ4%2FUwBKSC30cpRQHcvB4CsK%2BKZyKVS32voa225c%2F9m6UzV8"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 8afbf6410c1796e5-AMS
expires: Thu, 08 Aug 2024 02:10:31 GMT

GET
H3 200 index.js Show response
www.threatfabric.com/hs/hsstatic/HubspotToolsMenu/static-1.349/js/ 12 KB
5 KB 45ms
44ms Script
application/javascript 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hs/hsstatic/HubspotToolsMenu/static-1.349/js/index.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b987245cc5d802ec15d04b1797d14a16f002aca05348c13f79d31ecedecad8ac

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
via: 1.1 4a345f25fcb995602afaf132ccf353de.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1919650
x-amz-cf-pop: AMS58-P5
x-amz-server-side-encryption: AES256
content-security-policy: upgrade-insecure-requests
x-cache: Miss from cloudfront
x-amz-version-id: xQGlP28JK8czygjYT3ac5MmMcZh4SwPp
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 16 Jul 2024 20:51:48 GMT
server: cloudflare
etag: W/"804371e77c152132301ab9a09be49f93"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QZZ9Z6J9pYbxDcjRDM%2Fixp4DtTPNhyygpurS34rGKeYwRkBk96omo9tp%2BU6nxuburYjswjjB7%2FklxJeo4Ef3K18Mbcf3Lxu%2BTCdR5B%2FjwRN0pdH5%2B2Ep3EO1vwRS%2Bg3YGUTK2FFeAfjk7FFpUnQVKoMA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8afbf6410c1996e5-AMS
x-amz-cf-id: xIQI05H71-St4HP9W_4NdSHrVg_uM1ZCxzfFNQdzSl0w2I7NAGWvOg==
expires: Fri, 08 Aug 2025 02:09:01 GMT

GET
H2 200 6701575.js Show response
js.hs-scripts.com/ 2 KB
1 KB 152ms
122ms Script
application/javascript 2606:4700::6810:8cd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/6701575.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8cd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b48bd673b47904df8e3b64ca438f4167836fd08fd9baf45ce2e1b106b45e4ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 3db651f5-337b-4805-8055-bf1e7be71a59
x-envoy-upstream-service-time: 5
content-length: 680
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3db651f5-337b-4805-8055-bf1e7be71a59
last-modified: Thu, 08 Aug 2024 02:09:01 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-85b74c4c74-2mdnj
access-control-allow-credentials: true
cache-control: public, max-age=90
accept-ranges: bytes
cf-ray: 8afbf64138170c09-AMS
expires: Thu, 08 Aug 2024 02:10:31 GMT

GET in.js
platform.linkedin.com/ 0
0

GET
H3 200 tf-blogpost-banner-divider-01.svg
www.threatfabric.com/hubfs/Threatfabric/images/ 576 B
2 KB 60ms
59ms Image
image/svg+xml 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/images/tf-blogpost-banner-divider-01.svg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d92c25b1d90bdf3fb25373c5e3de35b1256f47a96575d58b4e6ae10be499d76d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-102446427186,FD-101619062546,P-6701575,FLS-ALL
age: 1066233
x-amz-request-id: 3N1BCYHKBZ98WJ05
x-amz-server-side-encryption: AES256
edge-cache-tag: F-102446427186,FD-101619062546,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"af4732c5d3ba47ba314c39750f2c2e6f"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1676379615960
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 95b26b715ee81beaff56d7e9f185da2e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: LvbdpHvwKMpHzOWR2c2lhGUzlD608lQ_
x-amz-cf-pop: LHR3-C2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-102446427186,FD-101619062546,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ALR9BjYNGFodfulDz5kuSdw5sSpqWwqMxvCows7GgIPe9eV/8fIKv70//wOsVY+D2h7IIMghzqY=
last-modified: Tue, 14 Feb 2023 13:00:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l6E8OaU1F41j84inBdSz%2FniG2sYupZm0eQ6MGZYIHGXVZHwwK08ZVFUgKCxwcMZbnkfhU%2BN4De1z%2BiZrqndHd43swARp9tk%2Bg9pYTmELi%2BC%2BsjABd4aKA4Ya35bFjIDXDDMyj9wCW%2Faud8rjhNpvdknG"}],"group":"cf-nel","max_age":604800}
cf-ray: 8afbf6412c3d96e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: -THlznLzQF1mNWyrSBifuPHzwa-QiCblKS4Fwg2dcIcpNxtG10ohlw==

GET
H3 200 tf-offer-bg-divider-01.svg
www.threatfabric.com/hubfs/Threatfabric/images/ 556 B
2 KB 73ms
73ms Image
image/svg+xml 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/images/tf-offer-bg-divider-01.svg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

639127081177ea5058409066f97e84fb8ffdad426754956248f4ed77b45bd606

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-102241528447,FD-101619062546,P-6701575,FLS-ALL
age: 1077684
x-amz-request-id: KNMX2XXJV80B0VPB
x-amz-server-side-encryption: AES256
edge-cache-tag: F-102241528447,FD-101619062546,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"3c05186b36e65acf42dc5ace50a34360"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1676276654996
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 d143bdfb7cce4cf7ec0bcf9ec13e5914.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: .HXvxpbfuTohzDbnYKcJooLLN3h3f42c
x-amz-cf-pop: AMS1-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-102241528447,FD-101619062546,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 4KqWf1Pi8ZuYzBPAiKYD+OLNrNYgukkQx+rPG4gsfXP8SD4RVUzpYaAvuO1PECBntZKTaCRWZE0=
last-modified: Mon, 13 Feb 2023 08:24:16 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yi%2FIZ3N1CL1wyKTzsr8%2Fjyv4%2FRMtCLZ6IxpBVfAl3H%2FX9WKPGuBfgJCypdHQYZMwxjjatlH5xXbW0V2hy0TbYyIrzBBhU2PsDYyq8xCK594obDCMnyWgWvE5T2fgzrmRBhGcgrjAOPY1N%2BUr1pYHvm3v"}],"group":"cf-nel","max_age":604800}
cf-ray: 8afbf6412c4196e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: Em2qv3Oc9kWE8OUCXzqE4qT5LZRqF6yIS0nad5Swz0aC2QYnbl-23Q==

GET
H3 200 Kanit-Light.ttf
www.threatfabric.com/hubfs/Threatfabric/fonts/kanit/ 163 KB
64 KB 105ms
105ms Font
font/ttf 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/fonts/kanit/Kanit-Light.ttf

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/child.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7b87f1b48aa75784afb205b3d567664641bc056af2e20b5873da2c90605b7d2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/hs-fs/hub/6701575/hub_generated/template_assets/101040140217/1714390879224/Threatfabric_Hatch/child.min.css
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-112819245065,FD-112819245060,P-6701575,FLS-ALL
age: 1079512
x-amz-request-id: F11WHKW8W5EBRASX
x-amz-server-side-encryption: AES256
edge-cache-tag: F-112819245065,FD-112819245060,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"0c443ef22ca3ce98e0b670310f5ebb36"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/ttf
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1682489433648
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 1d01c9eafefacaa6322fccd6199f781c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: Tqpimg7QV74KE9DspBbqQUupRuYfGKOs
x-amz-cf-pop: LHR3-C2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-112819245065,FD-112819245060,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: N/hwsFLaHxyn1bmr4yoYfq9FZbe00PHf/q1RVJ7MIGqz9jL40DtRAYktqTPQxUFLFVoTqdQP+Kw=
last-modified: Wed, 26 Apr 2023 06:10:34 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dyv6ZsPM8HVlfG9UijkS69MRZ5dFWBOuQ0MLFKwGGLz%2BP6swY%2Bpz6fbIyyt0tQRkE%2BG6%2BCnYG%2FvHLJh15InpQrDMAG869v6A9d1FWS1GLK9F44b0cp%2BoagmNHjEy6JkbRNNcJHZoOeyIYhNg7lWNxSJH"}],"group":"cf-nel","max_age":604800}
cf-ray: 8afbf6413c5c96e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: E0laXtfU4XBQr7wqbNZv5eKgu2xiLePT5A6r-fyx3Og2HhnBPt-Bxg==

GET
H3 200 TF_Chameleon_2024.jpg
www.threatfabric.com/hubfs/ 1 MB
1 MB 59ms
58ms Image
image/webp 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hubfs/TF_Chameleon_2024.jpg

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4a9751170e6da5cc2fcd11f23ac958ad2448eec0e521a6582cc78f40a8b0b50

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-174910066061,P-6701575,FLS-ALL
age: 220801
x-amz-request-id: 5Q5XTWBCBBKNDQRB
x-amz-server-side-encryption: AES256
edge-cache-tag: F-174910066061,P-6701575,FLS-ALL
x-amz-replication-status: PENDING
content-disposition: inline; filename="TF_Chameleon_2024.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-meta-access-tag: public-indexable
cf-bgj: imgq:85,h2pri
etag: "4b1d028b3b536c5cb6939a65c97ab82c"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1722862138532
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 4711a6160d191e5827e72db73c0acff8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: O5SpcQIy6.nvASCw9aknnnxLKCEqo1EJ
x-amz-cf-pop: BRU50-P1
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=2634898
x-cache: Miss from cloudfront
cache-tag: F-174910066061,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 1363108
x-amz-id-2: qMytnaOuWHgGnbBIW1NZX+7bLU1zTwB07jQ81wR4aUzglJu2FEcuFm7ITFdJ97P28CS779ygGxI=
last-modified: Mon, 05 Aug 2024 12:48:59 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U%2FjXN2WiRI7Dl93HBmT3HuEcBu8H8JC12aGahLdfQIMZFHJQWy1%2BK3MoQPFJZV7Vz1ejpnBNUR361l%2Be4XLbulgNJVrUG%2BWTUEWW8%2BXvmvKS17oazAnc4%2B7N9YHkAO2QLLke%2Bh6o29odnFhISCemGh1t"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 8afbf6413c5396e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: DnDk7gVuh1NwvoTlOz7gdjVsC1aQJ7Mnj3XJvGjDiILP4NKt9PECnw==

GET
H3 200 Slide1-Jul-29-2024-03-09-02-8496-PM.png
www.threatfabric.com/hs-fs/hubfs/ 84 KB
85 KB 54ms
53ms Image
image/webp 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hs-fs/hubfs/Slide1-Jul-29-2024-03-09-02-8496-PM.png?width=1920&height=1080&name=Slide1-Jul-29-2024-03-09-02-8496-PM.png

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6efa0b8881d6dab6c36d28b3d869c6369e0e5c134580dcee0940a7208db3a02c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 043fc2faaa02eeb59193e3fa300adb6a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-174297865238,P-6701575,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 85758
cf-resized: internal=ok/m q=0 n=799+407 c=62+345 v=2024.7.0 l=85758
last-modified: Mon, 29 Jul 2024 15:09:04 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cflEh0RnOUfFPWht81OtVC-WdTIKc0wKeDGijcIDPWDQ:acea380d913d323525e46b09990a53c7"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oXAyYGKsJVZ9%2BDpGVHIUud5%2FxuDnRBMCWoQgsLMHHH6rLlFyW1VPYu8YXaEXRQEiOm8yQMslDHD6%2F6qgTNKc4PZmb4xdt0Q6gvjeL1W2TD9wOGqm%2FB%2F%2BjozMaVMUzMasM41zstcSezOProNA3lIo5Crz"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 8afbf6413c5796e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net

GET
H3 200 Slide2-Jul-29-2024-03-10-32-6973-PM.png
www.threatfabric.com/hs-fs/hubfs/ 38 KB
39 KB 66ms
65ms Image
image/webp 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.threatfabric.com/hs-fs/hubfs/Slide2-Jul-29-2024-03-10-32-6973-PM.png?width=1920&height=1080&name=Slide2-Jul-29-2024-03-10-32-6973-PM.png

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

632060d538a0627046b33af9b4ec6718b2efef8361ebbbaf7e49713868a8fe87

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 609487f3e9c1fd7ddcc7b01d9818bfec.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-174297283336,P-6701575,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 39320
cf-resized: internal=ok/m q=0 n=523+416 c=49+367 v=2024.7.0 l=39320
last-modified: Mon, 29 Jul 2024 15:10:34 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfRSTTdm6gNUh2DRch3KgwalN7IKc0wKeDGijcIDPWDQ:eb3a82878b1b824b8470f174e8ffa703"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FtpTNFBTcpz0QYcM5%2FmV0w0JZAgk22gTWs2MnFThSrZ5NF3S5NzQNZKRyVCaFwHlNZPi6upYdr110i3AqZWJift63BszUFHDTqrnd%2FfXTUTXbcwXNo0huPanmU0J6svWG9K9gMb09fg9lQdQuvJKDe7F"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 8afbf6413c5996e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 240ms
7ms Script
application/javascript 2a02:26f0:3500:10::210:a9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2024 05:33:09 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=62860
accept-ranges: bytes
content-length: 14597

GET sdk.js
connect.facebook.net/en_GB/ 0
0

GET widgets.js
platform.twitter.com/ 0
0

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 435ms
211ms XHR
text/plain 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=6701575

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/hs/hsstatic/HubspotToolsMenu/static-1.349/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: no-sniff
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 2aff8b1f-81cb-43d9-8ec1-d21d18acafc9
x-envoy-upstream-service-time: 4
x-evy-trace-route-configuration: listener_https/all
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8afbf642e8520a7b&resource=unknown"
x-evy-trace-listener: listener_https
x-request-id: 2aff8b1f-81cb-43d9-8ec1-d21d18acafc9
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-vjwjs
cache-control: max-age=0
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
cf-ray: 8afbf642e8520a7b-AMS

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 158ms
22ms Script
application/javascript 2606:4700::6811:df98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6701575.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:df98 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e1b1a37caa8b7627123aeb0e23ad3a2ac14d4ad48be7aabb2ca7ca9da218ef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
via: 1.1 3d4bfc42e9575ee1f9559241c9e3f464.cloudfront.net (CloudFront)
x-amz-version-id: UIOsIr3qFS9r3wFn4ECf3yNr1.R8N2aA
cf-cache-status: HIT
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P3
age: 283
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.572/bundles/pixels-release.js&cfRay=8afbef552a8b9700-AMS
x-cache: Hit from cloudfront
x-hubspot-correlation-id: cf227acb-7d82-44a4-83c7-8518a11c4024
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 9
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: cf227acb-7d82-44a4-83c7-8518a11c4024
last-modified: Tue, 06 Aug 2024 19:11:03 UTC
server: cloudflare
etag: W/"45a803cc17701ff8c7710294960c14c7"
vary: accept-encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: MISS
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-vjwjs
cf-ray: 8afbf642efea1c8a-AMS
x-amz-cf-id: dLI_Tr0AzUsE7q2r2zB5Y8pXNWn1HUXYx3FEUl68-ldUIMIPFikqGg==
x-hs-target-asset: adsscriptloaderstatic/static-1.572/bundles/pixels-release.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/6701575/ 75 KB
28 KB 435ms
300ms Script
text/javascript 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/6701575/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6701575.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca21bb556f4c5d4b3d249e8c26843126facce3d88c00402c0871adeb7799c383

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
x-amz-version-id: 5zHnbWyEsT4TOfUQMfNFlBNy933D_Z26
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: 0DF90GW5GXNC3P7J
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: fe6bbbf1-ad3d-4769-9e93-830644c48cbc
x-envoy-upstream-service-time: 108
x-amz-id-2: 8rQo3/GkVyJIkE5AsAyYtyW2cP4r30gMuDb/LX07rw5EDqGEtth/bK/noyoV11YnhiWJ0KKFEgM=
x-evy-trace-listener: listener_https
x-request-id: fe6bbbf1-ad3d-4769-9e93-830644c48cbc
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 16 Jul 2024 22:33:24 GMT
server: cloudflare
etag: W/"86d757967f20c9c7e5da7b99c9af0077"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-w85d2
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8afbf642ded3b98e-AMS
expires: Thu, 08 Aug 2024 02:14:02 GMT

GET
H2 200 6701575.js Show response
js.hs-analytics.net/analytics/1723082700000/ 68 KB
25 KB 283ms
147ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1723082700000/6701575.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6701575.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46938042a68613d2f789863aa1773948f6dae2a485d65e8043f22664f0c485fa

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: MISS
x-amz-request-id: 5HCH432604CN00SB
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: d703f78d-9039-42fb-8573-cdc850237871
x-envoy-upstream-service-time: 23
x-amz-id-2: kzkl5YxXgbYLrqabumxOoxcg6iYQQbxnDnWLYH1kE9LW0mRoDZUSidALCsFEVWJrQr6Gx2qU/OhGmf9nipPUEqpX4xfPA/M0
x-evy-trace-listener: listener_https
x-request-id: d703f78d-9039-42fb-8573-cdc850237871
x-evy-trace-route-configuration: listener_https/all
last-modified: Sat, 03 Aug 2024 00:27:45 GMT
server: cloudflare
etag: W/"dd168bbc3df36361a1ab57938993c17e"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-gfff7
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8afbf642e86f670c-AMS
expires: Thu, 08 Aug 2024 02:14:01 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 247ms
112ms Script
application/javascript 2606:4700::6810:6bfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6701575.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6bfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c78fab07d4ee469def66170220968c4e790992e5adc971a34edc7eabc695e79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
via: 1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront)
x-amz-version-id: FCxgV_B3nWescR00el0uV0Hdj2lazDBZ
cf-cache-status: EXPIRED
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 34306b7c-1047-4088-9179-9f7128f17e7a
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.586/bundles/project.js&cfRay=8afbf642ed7a670a-AMS
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 34306b7c-1047-4088-9179-9f7128f17e7a
last-modified: Tue, 23 Jul 2024 12:55:20 UTC
server: cloudflare
etag: W/"ac41634810840adc02ea51748cb19c2f"
vary: accept-encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-sw27x
cf-ray: 8afbf642ed7a670a-AMS
x-amz-cf-id: S196t7k4WESAVImoRBy8N2G8Eud57aBWphso8YkfPFXvLw_GUO2QZw==
x-hs-target-asset: collected-forms-embed-js/static-1.586/bundles/project.js

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
24 KB 176ms
42ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6701575.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

720b43e5950b3ef9c934b9253a76353a916cc4399cc2d17bdc5a508ce2569d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1294/bundles/project.js&cfRay=8af95987a8256674-AMS
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"ca106ef78092107b8d4a40131d641c01"
vary: accept-encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1294/bundles/project.js
date: Thu, 08 Aug 2024 02:09:01 GMT
x-amz-version-id: GMZ9HyPHjtzB9hq9Kp4nuMbTlOz7NvmB
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 3c43e000c50d5633eb558057710f3c54.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: b65b1fd3-4783-43bf-8f1a-48d7635d50a4
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: b65b1fd3-4783-43bf-8f1a-48d7635d50a4
last-modified: Mon, 29 Jul 2024 11:16:10 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j%2FqO44fkPJvMyaazO6Nysus%2B7RDBdAEdk6YFSsrJABaNE493OE1X2%2Fzgfpr9eVOblRk%2BO%2BJ%2FuUFf2fDEcrAjr%2BVqYTsy7%2FXcpaK3kDEnSYtDgTwmgp4Jp4m7NdnPdqX%2BakROvob87N50oCEg"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-dqn98
cf-ray: 8afbf642dbb50bcc-AMS
x-amz-cf-id: DY-8jASqCI1qkC-M_DT7qpUaLAd03YBE4fgAQjUUBsa-o77NsXRAfA==

GET attribution_trigger
px.ads.linkedin.com/ 0
0

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&e_ipv6=A...

0
267 B

215ms
105ms

Image
application/javascript

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&e_ipv6=AQJvlDm9Eg5PJgAAAZEvvyaJLnaBMhfugv-CD5S2qbF1GiiTDr5XpVJTT-Qq0Hqa7KepbGdvN7uYNqQut0aR99mtNw8lNw
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 3491AB282AEC41EF85C0576CAF9ABE19 Ref B: FRA231050414049 Ref C: 2024-08-08T02:09:02Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYfIoKysF/B/9WBZvjFFg==

Redirect headers

date: Thu, 08 Aug 2024 02:09:01 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 77B9DA77AE834423ADD3B5D92D2548FB Ref B: FRAEDGE1117 Ref C: 2024-08-08T02:09:01Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&e_ipv6=AQJvlDm9Eg5PJgAAAZEvvyaJLnaBMhfugv-CD5S2qbF1GiiTDr5XpVJTT-Qq0Hqa7KepbGdvN7uYNqQut0aR99mtNw8lNw
x-li-source-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYfIoKt4Zlppo/Kn10vmw==

GET
H2 200 attribution_trigger
px.ads.linkedin.com/ 2 B
782 B 320ms
276ms Image
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app
Requested by: Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:01 GMT
content-encoding: gzip
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cache: CONFIG_NOCACHE
x-li-uuid: AAYfIoKt5GV343wrEZFIdQ==
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 4EB9BF68CA4D4FA897567F2769975095 Ref B: FRAEDGE1117 Ref C: 2024-08-08T02:09:01Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-lva1
access-control-allow-origin: *
x-li-source-fabric: prod-lor1
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
access-control-allow-headers: *
x-fs-uuid: 00061f2282ade46577e37c2b11914875

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 1 KB
2 KB 132ms
131ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=6701575&currentUrl=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&contentId=174294865261

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d48be5a4ac16e9b30ee152be5286271527e4c4054c2d13ea01a4051645a8e3c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: dda397bd-f4ce-4f3d-a935-4ce63e54148f
x-envoy-upstream-service-time: 20
content-length: 665
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: dda397bd-f4ce-4f3d-a935-4ce63e54148f
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rjlRh%2Fcgbo9XrjAUHQXZhJvVPHTcPz52Gacs9gLh7in%2FGqsJmzD9YNeweLY1sImjQXidTs9%2BXXGh5wExy1d00mIbMwPy590L77xKZvFw2uvDeOCbTs70vwC7ZhhdHw74LfCR%2B569c%2F%2F5KSjhQscm2wzDFCxqBbwOz5Y%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8afbf6433bdc0bcc-AMS
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-x2zq5

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 135 B
491 B 117ms
116ms XHR
application/json 2606:4700::6810:6bfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=6701575&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6bfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d4e95bd54c3e6a43268f14f3488db18f087c70f4ba9ee351d31780db8573b76

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: cde77257-8330-4d06-a057-2a826db9b42d
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: cde77257-8330-4d06-a057-2a826db9b42d
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.threatfabric.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-bc6nt
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8afbf643bdfa670a-AMS

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
926 B 148ms
126ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.threatfabric.com
URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 5df66263-55be-4f9f-b329-e633a35290ac
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5df66263-55be-4f9f-b329-e633a35290ac
last-modified: Thu, 08 Aug 2024 02:09:02 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-png4t
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8afbf6442f516620-AMS

GET
H3 200 hs-web-interactive-6701575-139494617102
threatfabric-6701575.hs-sites.com/ Frame E738 0
0 450ms
425ms Document
text/html 2606:4700::6812:e072
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://threatfabric-6701575.hs-sites.com/hs-web-interactive-6701575-139494617102

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e072 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: false
alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=10,max-age=5
cache-tag: CT-139494617102,P-6701575,PGS-ALL,SW-2
cf-cache-status: EXPIRED
cf-ray: 8afbf64438d11c8a-AMS
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html;charset=utf-8
date: Thu, 08 Aug 2024 02:09:02 GMT
edge-cache-tag: CT-139494617102,P-6701575,PGS-ALL,SW-2
last-modified: Thu, 08 Aug 2024 02:09:02 GMT
server: cloudflare
vary: origin, Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 92
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/cms-hs-sites-td/envoy-proxy-fffdb9b56-f2d8f
x-evy-trace-virtual-host: all
x-hs-cache-config: BrowserCache-5s-EdgeCache-10s
x-hs-content-campaign-id: 7436f6e2-b46a-4ea1-9c6e-4aa7d59b7348
x-hs-content-id: 139494617102
x-hs-hub-id: 6701575
x-hubspot-correlation-id: 508c5482-db93-4aa6-bb38-e790b53f52b4
x-request-id: 508c5482-db93-4aa6-bb38-e790b53f52b4
x-robots-tag: none

GET
H2 200 cf-location Show response
js.hs-banner.com/v2/ 5 B
148 B 50ms
23ms Fetch
text/plain 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/cf-location
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/6701575/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b28ae40ac9ef82a5f8426c454cf12d9186a8e6813f6244bb9dddbef59af95071

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=1500
cf-ray: 8afbf644faa366c0-AMS
content-length: 5

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
865 B 126ms
15ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/6701575/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Aug 2024 02:09:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 08 Aug 2024 01:48:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Aug 2024 02:09:02 GMT

POST
H2 204 view
js.hs-banner.com/v2/activity/ 0
0 135ms
134ms Fetch 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/v2/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/6701575/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 08 Aug 2024 02:09:02 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator, envoyset-translator
x-hubspot-correlation-id: 79e7370f-f9c4-4250-96fd-8d5c8b16c459
x-envoy-upstream-service-time: 23
x-evy-trace-route-configuration: listener_http/all, listener_https/all
x-evy-trace-listener: listener_http, listener_https
x-request-id: 79e7370f-f9c4-4250-96fd-8d5c8b16c459
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-virtual-host: all, all
x-evy-trace-served-by-pod: iad02/private-hubapi-td/envoy-proxy-7f45f7f95b-szzc4, iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-wxrdh
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-allow-origin: https://www.threatfabric.com
access-control-allow-credentials: true
access-control-max-age: 604800
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8afbf646cb9166c0-AMS

OPTIONS
H2 200 view
js.hs-banner.com/v2/activity/ Frame 0
0 313ms
288ms Preflight
application/octet-stream 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.threatfabric.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.threatfabric.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 8afbf644faa566c0-AMS
content-length: 0
content-type: application/octet-stream
date: Thu, 08 Aug 2024 02:09:02 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 1
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-wgwsj
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 93dc067c-4782-4561-a05b-3377a8ad359e
x-request-id: 93dc067c-4782-4561-a05b-3377a8ad359e

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 39ms
15ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-SZHLN4DST6&gtm=45je4851v896951265za200&_p=1723082941601&gcs=G100&gcd=13q3qPq2q5&npa=1&dma_cps=-&dma=1&tag_exp=0&gdid=dZTQ1Zm&cid=1579302185.1723082942&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_s=1&sid=1723082941&sct=1&seg=0&dl=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&dt=Chameleon%20is%20now%20targeting%20employees%3A%20Masquerading%20as%20a%20CRM%20app&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1317
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SZHLN4DST6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Aug 2024 02:09:02 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.threatfabric.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 34ms
13ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 06 Aug 2024 14:56:39 GMT
x-content-type-options: nosniff
age: 126743
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Aug 2025 14:56:39 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 29ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.threatfabric.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 07 Aug 2024 11:39:44 GMT
x-content-type-options: nosniff
age: 52158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Aug 2025 11:39:44 GMT

POST /
px.ads.linkedin.com/wa/ 0
0

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
919 B 138ms
137ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=1240600147&v=1.1&a=6701575&pi=174294865261&ct=blog-post&ccu=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&cpi=174294865261&cgi=101307487134&lpi=174294865261&lvi=174294865261&lvc=en&pu=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app&t=Chameleon+is+now+targeting+employees%3A+Masquerading+as+a+CRM+app&cts=1723082943471&rv=1&vi=e1a7ed9f8506354f7d4593a2a797523a&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d7102762-a917-4869-932e-b67666b1bfa0
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 14
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d7102762-a917-4869-932e-b67666b1bfa0
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3nUIRd0w6IOmr%2F5UHuyvqwPLaRt2xGeiAw1rJSoNNYPaczv1JP23OT%2BOPkF9JmRu3vQQJYhYINJAMrDi1ZqUuwjWq0i1wnmhhx35PkUBTpOizaapH0VcA0x3o7gxYtwZrNPstbvwj6PbtRM%2Flw1b"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-df5pc
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8afbf64cce820a7b-AMS
x-robots-tag: none

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
580 B 188ms
187ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=interactive-shown&value=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 02:09:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: c9c6803a-7cae-438c-8e7b-778424fbd1e2
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c9c6803a-7cae-438c-8e7b-778424fbd1e2
last-modified: Thu, 08 Aug 2024 02:09:03 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-lxhr8
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8afbf64ccc3f6620-AMS

GET
H3 200 threatfabric-icon-dark.svg
www.threatfabric.com/hubfs/Threatfabric/favicon/ 467 B
2 KB 42ms
41ms Other
image/svg+xml 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.threatfabric.com/hubfs/Threatfabric/favicon/threatfabric-icon-dark.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

57a5da7ac787966a0343f72308a274a6efbe29b054c45a39006d357f9a7dd4db

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-113881471036,FD-113881358172,P-6701575,FLS-ALL
age: 1071535
x-amz-request-id: 92WKN3XBE5AXWHMB
x-amz-server-side-encryption: AES256
edge-cache-tag: F-113881471036,FD-113881358172,P-6701575,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"fce2ca26ec3fee39e3f2c79385fef303"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1683027369208
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 08 Aug 2024 02:09:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 4d43f2ff38c53dabf47263f1495ad9c0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: QPlhIhds5bQd9SFyVnWczTf6KRniE2eW
x-amz-cf-pop: AMS1-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-113881471036,FD-113881358172,P-6701575,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: rmJvwrMd6BGOWzbZBpemudx/SmEAt9UJ/gRZLE2Fyc/arZ6SHduDtcYIOkRW3wMDNblTtelOvQcJ/BXW+scO3bDiui1Ic3BZ
last-modified: Tue, 02 May 2023 11:36:10 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dM9Ki0uFtY2fXIzgFXd3OrKPt6%2BV%2F5LFKZmNC668wo3I%2BbsaFDT2p9y%2FzNGWz4FRSuNNQghK3EuI8InUYQxSwHZspVJuGPoUpS1mydDrmyuPb3%2Fx%2BkT0VDQIyLAck0utaPcdECeKQWOKj1gfOoizcHkd"}],"group":"cf-nel","max_age":604800}
cf-ray: 8afbf64ccc4296e5-AMS
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: EOy4dlegdwoG1bfcuLPLBfZXjQacMUQaw3ASQ25C-8aa7OE3xtuf2g==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: platform.linkedin.com
URL: https://platform.linkedin.com/in.js

Domain: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Domain: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Domain: px.ads.linkedin.com
URL: https://px.ads.linkedin.com/attribution_trigger?pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app

Domain: px.ads.linkedin.com
URL: https://px.ads.linkedin.com/wa/

Verdicts & Comments Add Verdict or Comment

62 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.linkedin.com/	1970-01-20 22:39:29	Name: lidc Value: "b=VGST02:s=V:r=V:a=V:p=V:g=3304:u=1:x=1:i=1723082942:t=1723169342:v=2:sig=AQGmCUAlOKKkVBAj_GqFln7oCcMTwrrA"
.hsforms.com/	1970-01-20 22:38:04	Name: __cf_bm Value: X5WtXqT1K8.N4uqH_gzKK2AdRaDDRi_RUXcm6kdtWSc-1723082942-1.0.1.1-r71ZqufGgbz_ziC_6qlpdcKowMt3u1GN4mSKA3WP93UF1uw0BT._OLrlDWLD_I._MCNj_T2JzPqUIV1TrGh_sA
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: ScWCuvo0aycBe6RaWxXypP1ApxNDlioWvMPgLSccj.w-1723082942218-0.0.1.1-604800000
.linkedin.com/	1970-01-21 07:23:38	Name: bcookie Value: "v=2&53961b47-cb09-4eae-8f76-1412a1051f75"
.linkedin.com/	1970-01-21 02:57:14	Name: li_gc Value: MTswOzE3MjMwODI5NDI7MjswMjFKXZm6oXTTh365U10p+vsgiqKVpoHO6S2c9mW8012lMw==
.hs-sites.com/	1969-12-31 23:59:59	Name: __cfruid Value: 080f1a950c185d774f19f895d5e2ef89baa12e79-1723082943
.www.threatfabric.com/	1970-01-20 22:38:04	Name: __cf_bm Value: 34XqHDikiF9gLBcESyYODyYNLBSTk.Ptr8V2cGdsuE8-1723082943-1.0.1.1-OVPHY113mYI.rZYfwyC_kKuGwiI.R9o6ybRKRIhizEkBZ45JvMtuB0hQHh8qL7C2p0tIM3oWJmgUWReCCVmQ.w
.www.threatfabric.com/	1969-12-31 23:59:59	Name: __cfruid Value: 32c4d81d905904f487cd02e64df81c96f19265d2-1723082943
.hubspot.com/	1970-01-20 22:38:04	Name: __cf_bm Value: WuBeiBSIzj9R5UYVGJuau1YO_w_Pp0xlofmjVy55eB0-1723082943-1.0.1.1-LqZVZSwzu.xRn9ExKgcAwdDperT.fadX9QomckYyS6VF2_sY1WuAGtXsG.pm1fJ2nZk4KaD2h0CZ4bVYSoMsAw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: na5UeigHclRoSI2HJNYA7z0s.sRSNbMh4RNgmU4kYxs-1723082943604-0.0.1.1-604800000

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app Message: Received a response with no data for rule set "https://www.threatfabric.com/cdn-cgi/speculation-rules?url=www.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app" found in Speculation-Rules header.
security	error	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app Message: Refused to load the script 'https://platform.linkedin.com/in.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .hubspot.com cdnjs.cloudflare.com .hubspot.net .hs-scripts.com .hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net .hs-banner.com .hs-analytics.net .hsadspixel.net js.hscta.net .hscollectedforms.net .hsleadflows.net .hsforms.com .hsforms.net feedback.hubapi.com .usemessages.com snap.licdn.com *.doubleclick.net". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app(Line 1041) Message: Refused to load the script 'https://connect.facebook.net/en_GB/sdk.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .hubspot.com cdnjs.cloudflare.com .hubspot.net .hs-scripts.com .hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net .hs-banner.com .hs-analytics.net .hsadspixel.net js.hscta.net .hscollectedforms.net .hsleadflows.net .hsforms.com .hsforms.net feedback.hubapi.com .usemessages.com snap.licdn.com *.doubleclick.net". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app(Line 1042) Message: Refused to load the script 'https://platform.twitter.com/widgets.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .hubspot.com cdnjs.cloudflare.com .hubspot.net .hs-scripts.com .hubspotfeedback.com www.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ maps.googleapis.com static.hsappstatic.net .hs-banner.com .hs-analytics.net .hsadspixel.net js.hscta.net .hscollectedforms.net .hsleadflows.net .hsforms.com .hsforms.net feedback.hubapi.com .usemessages.com snap.licdn.com *.doubleclick.net". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Message: Refused to connect to 'https://px.ads.linkedin.com/attribution_trigger?pid=3969834&time=1723082941916&url=https%3A%2F%2Fwww.threatfabric.com%2Fblogs%2Fchameleon-is-now-targeting-employees-masquerading-as-crm-app' because it violates the following Content Security Policy directive: "connect-src 'self' .hubspot.com .hubapi.com .hs-banner.com .hscollectedforms.net .hsforms.com js.hscta.net .google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net".
security	error	URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Message: Refused to connect to 'https://px.ads.linkedin.com/wa/' because it violates the following Content Security Policy directive: "connect-src 'self' .hubspot.com .hubapi.com .hs-banner.com .hscollectedforms.net .hsforms.com js.hscta.net .google-analytics.com www.google.com maps.googleapis.com *.doubleclick.net".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header

Value

Content-Security-Policy

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.hubspot.com
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
cta-service-cms2.hubspot.com
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hubspot.com
perf-na1.hsforms.com
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
snap.licdn.com
static.hsappstatic.net
threatfabric-6701575.hs-sites.com
track.hubspot.com
www.googletagmanager.com
www.threatfabric.com
connect.facebook.net
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
2001:4860:4802:34::36
2606:2c40::c73c:6702
2606:4700::6810:6bfe
2606:4700::6810:7674
2606:4700::6810:8cd1
2606:4700::6811:190e
2606:4700::6811:ad5b
2606:4700::6811:afc9
2606:4700::6811:df98
2606:4700::6812:17b7
2606:4700::6812:593e
2606:4700::6812:e072
2606:4700::6813:afbc
2620:1ec:21::14
2620:1ec:50::12
2a00:1450:4001:80e::200a
2a00:1450:4001:81d::2008
2a00:1450:4001:830::2003
2a02:26f0:3500:10::210:a9a
0adb227efa2074c6ae2b5e686cf4d1949a6edfc05bd56fa81e34c9a2c69fb50a
0d65652e4a1175891a46374d16ec569329b2e667eedb5770ce7ce193fd8fd41a
2d5c291cc9ce12740d42109fbf4384252918103351a98793ffa71f764ea3e4cf
3b48bd673b47904df8e3b64ca438f4167836fd08fd9baf45ce2e1b106b45e4ba
3d4e95bd54c3e6a43268f14f3488db18f087c70f4ba9ee351d31780db8573b76
401925a1114f7003121630392768d35516be54a4028f01024528aeae99a45a56
42db2b6421ba0667a52a6f929b6f61decd0a6efd16ac1bde0701bcc0e132d4ea
46938042a68613d2f789863aa1773948f6dae2a485d65e8043f22664f0c485fa
5172f440714da51e243a13e0f93911405618326b2013313b682caa428c47e6ef
57a5da7ac787966a0343f72308a274a6efbe29b054c45a39006d357f9a7dd4db
63156dffa3667d9807dbba2aa8e9c4b2dbcd50a755bf72e0478cf542a533d730
632060d538a0627046b33af9b4ec6718b2efef8361ebbbaf7e49713868a8fe87
639127081177ea5058409066f97e84fb8ffdad426754956248f4ed77b45bd606
6685b4f71edb4ae81b8a710e36f8c794c3e731feeb17614e476daf056b06a824
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6efa0b8881d6dab6c36d28b3d869c6369e0e5c134580dcee0940a7208db3a02c
720b43e5950b3ef9c934b9253a76353a916cc4399cc2d17bdc5a508ce2569d74
74c17452683150ad0f623fdd9a849ba85d73fb9d221cebe9aa11db52969dbe23
7e9c6e361ad47dcbdc817cde52918b29e424ed462fbbcef27ae9d2c826e7ee63
863886e2347be57cf71d7ed3fc614593e94bbce61858cd8c0761ba7a78d2ace4
89bf8cdea73ce776d6b81d03837bc7f04af5e3946b839a3c0bfbf3094ad3f7be
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8e1b1a37caa8b7627123aeb0e23ad3a2ac14d4ad48be7aabb2ca7ca9da218ef5
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
928e23e6b9fcef82c5f1d1f05b6f7fc5a6e187c60195e59fbf16fc9d071ee057
98dfeb1d061e8788b320a130a84723813efed0b2518921f30b40cc8a09bf8ecf
a924c55af6e42515871fdd850703bea91aedd280d30febc3ddc9f674df234785
ae37720bad220c27736f9097566e8cec3bce2f45d980f509c193f54d6d4aea59
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b023c3b26ca69356ad0aa6b6296d5e6a337ec10ca1f8275483437202a03c381c
b28ae40ac9ef82a5f8426c454cf12d9186a8e6813f6244bb9dddbef59af95071
b4a9751170e6da5cc2fcd11f23ac958ad2448eec0e521a6582cc78f40a8b0b50
b754a50214c3af13ad5b80267b36a52a379030f4cdf28ea62bdc23121fb63963
b7b87f1b48aa75784afb205b3d567664641bc056af2e20b5873da2c90605b7d2
b987245cc5d802ec15d04b1797d14a16f002aca05348c13f79d31ecedecad8ac
c16d59010b5c7bc246cc28fa0b991da4aaf6ed332f99940a4d5bd29de1ad43de
c2c7b9abc29c9ae0977aba384eea9a1890bd77ee763daa7011dc87d23c1617d1
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c564955dad803a6139bc52a7d05b9fcceeec494e5aced6e9db08d20d8ff076ee
c78fab07d4ee469def66170220968c4e790992e5adc971a34edc7eabc695e79f
c917923119f99ca28c29eca25a2a4a9606edd23f26633bab2e212ce053dd5f1c
ca21bb556f4c5d4b3d249e8c26843126facce3d88c00402c0871adeb7799c383
d48be5a4ac16e9b30ee152be5286271527e4c4054c2d13ea01a4051645a8e3c3
d92c25b1d90bdf3fb25373c5e3de35b1256f47a96575d58b4e6ae10be499d76d
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc377d0b25d1c78cd2fb2d8c9b3cc8fe12db24bd47084deda1129905ca256099
e082d568fb44df37fa453a514a8e553c889abe144c5c73866c1f020e4ccfbc49
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa7fe4fd0aef1b94a3910f43b99060d1fcf2b12302726c4f52146ca1f613e516
fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc
ff63efd694d95b007183d6eacdbde18bea3d4f4c6cefb594e038d2a1efe209a2

www.threatfabric.com Open in urlscan Pro 2606:2c40::c73c:6702 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

66 Requests

91 %HTTPS

100 %IPv6

20 Domains

26 Subdomains

20 IPs

2 Countries

2153 kBTransfer

3419 kBSize

10 Cookies

2 Outgoing links

Redirected requests

66 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.threatfabric.com Open in urlscan Pro
2606:2c40::c73c:6702 Public Scan

Screenshot
Live screenshot

Full Image

66
Requests

91 %
HTTPS

100 %
IPv6

20
Domains

26
Subdomains

20
IPs

2
Countries

2153 kB
Transfer

3419 kB
Size

10
Cookies

66 HTTP transactions
0 data transactions