www.zscaler.com Open in urlscan Pro
2606:4700:4400::ac40:99eb Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Submission: On November 15 via api (November 15th 2024, 7:14:06 pm UTC) from BY — Scanned from DE

Summary HTTP 149 Redirects Links 29 Behaviour Indicators

Summary

This website contacted 31 IPs in 5 countries across 22 domains to perform 149 HTTP transactions. The main IP is 2606:4700:4400::ac40:99eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com. The Cisco Umbrella rank of the primary domain is 68501.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 28th 2024. Valid for: a year.

This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
56	2606:4700:440... 2606:4700:4400::ac40:99eb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.17.71.206 104.17.71.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
17	2.17.100.193 2.17.100.193	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	2600:9000:223... 2600:9000:223e:4600:c:d449:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2600:1f18:e8a... 2600:1f18:e8a:cd02:882c:d916:bae1:7722	14618 (AMAZON-AES) (AMAZON-AES)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	37.252.171.85 37.252.171.85	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:710... 2a02:26f0:7100::210:180	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0d::9b	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.194.132 151.101.194.132	54113 (FASTLY) (FASTLY)
1	54.217.115.217 54.217.115.217	16509 (AMAZON-02) (AMAZON-02)
2	108.128.50.9 108.128.50.9	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:762b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:752b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	35.161.58.191 35.161.58.191	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:10:... 2606:4700:10::ac43:b9b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
149	31

56 2606:4700:4400::ac40:99eb (United States)

ASN13335 (CLOUDFLARENET, US)

www.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.71.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2.17.100.193 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-17-100-193.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223e:4600:c:d449:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

ob.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:1f18:e8a:cd02:882c:d916:bae1:7722 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

obs.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

306-zej-256.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.85 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100::210:180 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0d::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.217.115.217 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-217-115-217.eu-west-1.compute.amazonaws.com

117186981.intellimizeio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.128.50.9 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-50-9.eu-west-1.compute.amazonaws.com

api.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:762b (United States)

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:752b (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.161.58.191 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-161-58-191.us-west-2.compute.amazonaws.com

log.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:b9b (United States)

ASN13335 (CLOUDFLARENET, US)

acsbapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.acsbapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
63	zscaler.com www.zscaler.com — Cisco Umbrella Rank: 68501 cms.zscaler.com info.zscaler.com — Cisco Umbrella Rank: 680312	1 MB
20	6sc.co j.6sc.co — Cisco Umbrella Rank: 5557 c.6sc.co — Cisco Umbrella Rank: 6739 ipv6.6sc.co — Cisco Umbrella Rank: 5633 eps.6sc.co — Cisco Umbrella Rank: 9024 b.6sc.co — Cisco Umbrella Rank: 3603	25 KB
10	iseaskies.com ob.iseaskies.com — Cisco Umbrella Rank: 581120 obs.iseaskies.com — Cisco Umbrella Rank: 410514	42 KB
9	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 329	195 KB
6	intellimize.co cdn.intellimize.co — Cisco Umbrella Rank: 46431 api.intellimize.co — Cisco Umbrella Rank: 39078 log.intellimize.co — Cisco Umbrella Rank: 37598	109 KB
5	zoominfo.com ws-assets.zoominfo.com — Cisco Umbrella Rank: 11137 ws.zoominfo.com — Cisco Umbrella Rank: 4514	17 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	576 KB
4	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 3 region1.analytics.google.com — Cisco Umbrella Rank: 4108	48 B
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5643	4 KB
3	google.de www.google.de — Cisco Umbrella Rank: 10745	191 B
3	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 stats.g.doubleclick.net — Cisco Umbrella Rank: 135	603 B
2	acsbapp.com acsbapp.com — Cisco Umbrella Rank: 3812 cdn.acsbapp.com — Cisco Umbrella Rank: 4086	116 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	211 B
2	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 96	3 KB
2	bing.com bat.bing.com — Cisco Umbrella Rank: 359	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	77 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3671	7 KB
1	intellimizeio.com 117186981.intellimizeio.com
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 495	701 B
1	mktoresp.com 306-zej-256.mktoresp.com	318 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 514	303 B
149	22

	Domain	Requested by
54	www.zscaler.com	www.zscaler.com
14	b.6sc.co	www.zscaler.com
9	cdn.cookielaw.org	www.zscaler.com cdn.cookielaw.org
8	obs.iseaskies.com	ob.iseaskies.com www.zscaler.com
7	info.zscaler.com	www.zscaler.com info.zscaler.com
5	www.googletagmanager.com	www.zscaler.com ob.iseaskies.com www.googletagmanager.com
4	ws.zoominfo.com	js.zi-scripts.com ws-assets.zoominfo.com
3	log.intellimize.co	cdn.intellimize.co
3	js.zi-scripts.com	www.zscaler.com js.zi-scripts.com
3	www.google.de	www.zscaler.com
3	www.google.com	2 redirects www.googletagmanager.com
2	api.intellimize.co	cdn.intellimize.co
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.facebook.com	www.zscaler.com
2	googleads.g.doubleclick.net	2 redirects
2	www.googleadservices.com	1 redirects www.googletagmanager.com
2	bat.bing.com	ob.iseaskies.com bat.bing.com
2	connect.facebook.net	ob.iseaskies.com connect.facebook.net
2	eps.6sc.co	j.6sc.co
2	ob.iseaskies.com	www.zscaler.com
2	j.6sc.co	www.zscaler.com j.6sc.co
2	munchkin.marketo.net	www.zscaler.com munchkin.marketo.net
2	cms.zscaler.com	www.zscaler.com
1	cdn.acsbapp.com	acsbapp.com
1	acsbapp.com	www.zscaler.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	117186981.intellimizeio.com	cdn.intellimize.co
1	cdn.intellimize.co	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	306-zej-256.mktoresp.com	munchkin.marketo.net
1	geolocation.onetrust.com	cdn.cookielaw.org
149	35

This site contains links to these domains. Also see Links.

Domain
threatlabz.zscaler.com
help.zscaler.com
admin.zscaler.net
admin.zscalerone.net
admin.zscalertwo.net
admin.zscalerthree.net
admin.zscalerbeta.net
admin.zscloud.net
admin.private.zscaler.com
admin.zpatwo.net
partners.zscaler.com
info.zscaler.com
securitypreview.zscaler.com
testmydefenses.com
customer.zscaler.com
community.zscaler.com
ir.zscaler.com
www.facebook.com
twitter.com
www.linkedin.com
github.com
threatlibrary.zscaler.com
www.twitter.com
www.youtube.com

Subject Issuer	Validity	Valid
www.zscaler.com DigiCert SHA2 Extended Validation Server CA	`2024-02-28` - `2025-02-23`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
info.zscaler.com WE1	`2024-11-05` - `2025-02-03`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-22` - `2025-10-24`	a year	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.iseaskies.com Amazon RSA 2048 M02	`2024-06-18` - `2025-07-18`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M02	`2024-08-29` - `2025-09-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-24` - `2024-11-22`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.googleadservices.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.de WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
zi-scripts.com WE1	`2024-09-22` - `2024-12-21`	3 months	crt.sh
cdn.intellimize.co R10	`2024-11-10` - `2025-02-08`	3 months	crt.sh
*.intellimizeio.com Amazon RSA 2048 M02	`2024-09-24` - `2025-10-23`	a year	crt.sh
api.intellimize.co Amazon RSA 2048 M03	`2024-09-24` - `2025-10-23`	a year	crt.sh
zoominfo.com E6	`2024-11-12` - `2025-02-10`	3 months	crt.sh
log.intellimize.co Amazon RSA 2048 M03	`2024-09-23` - `2025-10-22`	a year	crt.sh
acsbapp.com WE1	`2024-10-16` - `2025-01-14`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Frame ID: EB518F63476D9460569480A33D25845A
Requests: 140 HTTP requests in this frame

Frame: https://info.zscaler.com/index.php/form/XDFrame
Frame ID: 5528E7CE365CF288C9CD96ED2D5A9445
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: D79E872F2B4C151B840040C4C6032325
Requests: 2 HTTP requests in this frame

Frame: https://117186981.intellimizeio.com/storage.html
Frame ID: 1270BC5F0A94B3F399592D5F415C0768
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pikabot Updates | ThreatLabz

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

149
Requests

95 %
HTTPS

61 %
IPv6

22
Domains

35
Subdomains

31
IPs

5
Countries

2709 kB
Transfer

7950 kB
Size

23
Cookies

29 Outgoing links

These are links going to different origins than the main page.

URL: https://threatlabz.zscaler.com/
Title: ThreatLabz

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/phone-support
Title: Support

Search URL Search Domain Scan URL

URL: https://admin.zscaler.net/
Title: Zscaler Cloud Portal | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerone.net/
Title: Zscaler Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalertwo.net/
Title: Zscaler Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerthree.net/
Title: Zscaler Cloud Portal Three | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerbeta.net/
Title: Zscaler Cloud Portal Beta | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscloud.net/
Title: admin.zscloud.net

Search URL Search Domain Scan URL

URL: https://admin.private.zscaler.com/
Title: Zscaler Private Access Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zpatwo.net/
Title: Zscaler Private Access Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://partners.zscaler.com/s/partneronboarding
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://info.zscaler.com/zenith-live-on-demand
Title: Zenith Live

Search URL Search Domain Scan URL

URL: https://threatlabz.zscaler.com/cloud-insights/cloud-activity-dashboard
Title: ThreatLabz Analytics

Search URL Search Domain Scan URL

URL: http://securitypreview.zscaler.com/
Title: Security Preview

Search URL Search Domain Scan URL

URL: https://testmydefenses.com/ransomware-assessment
Title: Security and Risk Assessment

Search URL Search Domain Scan URL

URL: https://customer.zscaler.com/
Title: Customer Success Center

Search URL Search Domain Scan URL

URL: https://community.zscaler.com/
Title: Zenith Community

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/
Title: Zscaler Help Portal

Search URL Search Domain Scan URL

URL: https://ir.zscaler.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://tinyurl.com/23g8gtw8

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https://tinyurl.com/23g8gtw8%20%E2%80%94%20The%20(D)Evolution%20of%20Pikabot%22

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://tinyurl.com/23g8gtw8

Search URL Search Domain Scan URL

URL: https://github.com/andrivet/ADVobfuscator
Title: ADVobfuscator

Search URL Search Domain Scan URL

URL: https://threatlibrary.zscaler.com/threats/204a445f-a80e-41ff-a263-fb263bcca35d
Title: Win32.Trojan.PikaBot

Search URL Search Domain Scan URL

URL: https://threatlibrary.zscaler.com/threats/5111e9e6-a6bb-41a8-b1e0-830ed29ef647
Title: Win32.Downloader.PikaBot

Search URL Search Domain Scan URL

URL: https://www.facebook.com/zscaler
Title: Visit us on Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zscaler
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.twitter.com/zscaler
Title: Follow us on Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/ZscalerMarketing
Title: Subscribe our Youtube Channel

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbEC&pscrd=IhMIguqk74XfiQMVroyDBx1Fjh0SMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8 HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbEC&pscrd=IhMIguqk74XfiQMVroyDBx1Fjh0SMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7d7-SvVjdrWIHKgA1rZc1wL9p_oAPQXg&random=3668328243 HTTP 302
https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbEC&pscrd=IhMIguqk74XfiQMVroyDBx1Fjh0SMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7d7-SvVjdrWIHKgA1rZc1wL9p_oAPQXg&random=3668328243&ipr=y

Request Chain 112

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Pikabot%20Updates%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=2047689099.1731698030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECSidldmVudC1zb3VyY2UsIHRyaWdnZXI7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIwvjS74XfiQMV2ZuDBx3JwB_-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoQUlnUF9idVFZUXZLX0x1Y0NDLS1oY0VpMEFEajg5YUpnR19tTGJNc0t4N25UOGpZUENFQkVNMEZlYUxwYXRlRmRvVkc4OXJDY3Q1OXpwbnBFak5Fcw HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Pikabot%20Updates%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=2047689099.1731698030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECSidldmVudC1zb3VyY2UsIHRyaWdnZXI7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIwvjS74XfiQMV2ZuDBx3JwB_-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoQUlnUF9idVFZUXZLX0x1Y0NDLS1oY0VpMEFEajg5YUpnR19tTGJNc0t4N25UOGpZUENFQkVNMEZlYUxwYXRlRmRvVkc4OXJDY3Q1OXpwbnBFak5Fcw&is_vtc=1&cid=CAQSKQCa7L7dTwBxYIMG2I-qA6FbJ_D_KBWKLfVRw5_e3REv0x46juGxA8gY&random=3518684371 HTTP 302
https://www.google.de/pagead/1p-conversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Pikabot%20Updates%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=2047689099.1731698030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECSidldmVudC1zb3VyY2UsIHRyaWdnZXI7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIwvjS74XfiQMV2ZuDBx3JwB_-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoQUlnUF9idVFZUXZLX0x1Y0NDLS1oY0VpMEFEajg5YUpnR19tTGJNc0t4N25UOGpZUENFQkVNMEZlYUxwYXRlRmRvVkc4OXJDY3Q1OXpwbnBFak5Fcw&is_vtc=1&cid=CAQSKQCa7L7dTwBxYIMG2I-qA6FbJ_D_KBWKLfVRw5_e3REv0x46juGxA8gY&random=3518684371&ipr=y

149 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request d-evolution-PIKABOT Show response
www.zscaler.com/blogs/security-research/ 399 KB
69 KB 4886ms
4716ms Document
text/html 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

8f8c10f0ca1014d8cdfba696150e67da4dbb97885260f13276dd2284ec149ff0

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

age: 4
cache-control: public,max-age=0,must-revalidate
cache-status: "Next.js"; fwd=miss, "Netlify Durable"; fwd=stale; ttl=-88456; stored, "Netlify Edge"; fwd=miss
cf-cache-status: DYNAMIC
cf-ray: 8e318f507c2c9750-FRA
content-encoding: br
content-security-policy: default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://*.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com *.mountain.com https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://*.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://*.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://*.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://*.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://*.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
content-type: text/html; charset=utf-8
date: Fri, 15 Nov 2024 19:13:44 GMT
netlify-vary: header=x-nextjs-data|x-next-debug-logging|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: cloudflare
strict-transport-security: max-age=31536000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN https://cms.zscaler.com
x-nf-request-id: 01JCRKXKM38QQMQ39KZTH1QW1J
x-powered-by: Next.js
x-xss-protection: 1; mode=block

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/ 356 KB
41 KB 118ms
37ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/OtAutoBlock.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eddd884436be08bc6ecaff1ea001f0f68eea7fe12664000a6f3646e07961a061

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: wwQGGjy2I9fD9PfR8JuF1w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD0587A30445E4
age: 14494
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 16 Nov 2024 19:13:44 GMT
date: Fri, 15 Nov 2024 19:13:44 GMT
content-type: application/javascript
last-modified: Fri, 15 Nov 2024 15:10:27 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 693e9672-f01e-0056-4070-377bfa000000
cf-ray: 8e318f6e8c3435ec-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41741
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 107ms
27ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: Vo/d0f3ZefkwyML/PnJnjg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD03B52B60A337
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 55736
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:44 GMT
content-type: application/javascript
last-modified: Wed, 13 Nov 2024 07:31:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8676ee84-f01e-0019-699f-35bfe2000000
cf-ray: 8e318f6e8c3635ec-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7212
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 343 KB
343 KB 1596ms
1572ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fblog-tile-img-700x467-ransomware.jpg&w=3840&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5bf9e709edea93b24c7135cdc0dd210313fd00a76c4ce484cc9bd13f14add1c

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 4
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:46 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 19:13:46 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f6f2f389750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 350832
x-nf-request-id: 01JCRKXRCC2RP9ZD378ECSYZWE
cache-status: "Netlify Edge"; fwd=miss
server: cloudflare

GET
H2 200 219e54771de95554-s.p.woff2
www.zscaler.com/_next/static/media/ 37 KB
37 KB 52ms
45ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/219e54771de95554-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "ee94ab2a11412903ad9756e2edb68d05-ssl"
age: 6398
x-content-type-options: nosniff
cf-ray: 8e318f6e1de89750-FRA
accept-ranges: bytes
content-length: 37876
x-nf-request-id: 01JCRKXR7CP266XP5FHY0KGHZN
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 86085b213eb89904-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
39 KB 39ms
32ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/86085b213eb89904-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "9430f4d344e4fa79ef6a839ba362694c-ssl"
age: 6557
x-content-type-options: nosniff
cf-ray: 8e318f6e2dea9750-FRA
accept-ranges: bytes
content-length: 40264
x-nf-request-id: 01JCRKXR733VRYR13CEZATG5DW
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 9cdafb0650413334-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
40 KB 60ms
53ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/9cdafb0650413334-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "aa81c4751d270062c6783d25c81b8021-ssl"
age: 6488
x-content-type-options: nosniff
cf-ray: 8e318f6e2deb9750-FRA
accept-ranges: bytes
content-length: 40336
x-nf-request-id: 01JCRKXR7GJCBZR7XM685Z8W27
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 4012cc4b67ad157d-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
10 KB 85ms
79ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/4012cc4b67ad157d-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "93ae142d2bfd17c936f3d91401658758-ssl"
age: 6490
x-content-type-options: nosniff
cf-ray: 8e318f6e2dec9750-FRA
accept-ranges: bytes
content-length: 9592
x-nf-request-id: 01JCRKXR7HZ0QXWPTTSC92QMN5
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 41998fdc1b8220a0-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
10 KB 57ms
51ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/41998fdc1b8220a0-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "672d4a5030823e96757755c555bf2027-ssl"
age: 6814
x-content-type-options: nosniff
cf-ray: 8e318f6e2ded9750-FRA
accept-ranges: bytes
content-length: 9620
x-nf-request-id: 01JCRKXR7JDR9XFCMGTRCYKG9H
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 edb9f1eb1c1a7ead-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 67ms
61ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/edb9f1eb1c1a7ead-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "e32ff74f0d5d916b5dda832b01fd5fc8-ssl"
age: 6380
x-content-type-options: nosniff
cf-ray: 8e318f6e2dee9750-FRA
accept-ranges: bytes
content-length: 8780
x-nf-request-id: 01JCRKXR7FM1XHDES2WQM60QQR
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 ce9b84dce7581e2b-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 68ms
62ms Font
font/woff2 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/ce9b84dce7581e2b-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "067a5289e0e684ba833d5d7b2beb3f51-ssl"
age: 6804
x-content-type-options: nosniff
cf-ray: 8e318f6e2df19750-FRA
accept-ranges: bytes
content-length: 8764
x-nf-request-id: 01JCRKXR7J4DBPXN9DBX8T3PQ9
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 0700b5f58933a14a.css
www.zscaler.com/_next/static/css/ 118 KB
23 KB 31ms
25ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/0700b5f58933a14a.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d04e3c8f040925ea84463c20dc7bfcafb5ccb461b9a4c484680ba09af30ca7ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"3cd8386312f5a7ddd06e0d20c859f5c7-ssl-df"
age: 6489
x-content-type-options: nosniff
cf-ray: 8e318f6e1ddb9750-FRA
x-nf-request-id: 01JCRKXR6VK30C9KSV5KT01KPW
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 3af0ea8ee1d54b3f.css
www.zscaler.com/_next/static/css/ 80 KB
11 KB 47ms
41ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/3af0ea8ee1d54b3f.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7a807c808a7b103144313c0e6c26f870-ssl-df"
age: 6814
x-content-type-options: nosniff
cf-ray: 8e318f6e1ddd9750-FRA
x-nf-request-id: 01JCRKXR776F2XV76WTR4DEQCW
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 60ab7ffa9f7999ec.css
www.zscaler.com/_next/static/css/ 849 B
390 B 50ms
45ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/60ab7ffa9f7999ec.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4fd28ce5d07640308fd628361ee9dd2e-ssl"
age: 6116
x-content-type-options: nosniff
cf-ray: 8e318f6e1ddf9750-FRA
x-nf-request-id: 01JCRKXR7E10NJNBHD3XGQCMC1
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
server: cloudflare

GET
H2 200 54b114f76a2643a4.css
www.zscaler.com/_next/static/css/ 14 KB
2 KB 82ms
76ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/54b114f76a2643a4.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9b8c484af22ed99c9052a8a53f1fb90c-ssl-df"
age: 321
x-content-type-options: nosniff
cf-ray: 8e318f6e1de19750-FRA
x-nf-request-id: 01JCRKXR7E49ZHD2W7FDVMGN2S
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 100087b4636276ac.css
www.zscaler.com/_next/static/css/ 16 KB
2 KB 86ms
81ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/100087b4636276ac.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f6d94f2c0cb031ee68a4125e2ec5bcda8c21d0187affabb22995d0e2a941e60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9c4b279f1982da43a3cdb4f54bc81804-ssl-df"
age: 6398
x-content-type-options: nosniff
cf-ray: 8e318f6e1de29750-FRA
x-nf-request-id: 01JCRKXR77S3GCCYJQGQT1BRVK
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 455227249223c84c.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 40ms
35ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/455227249223c84c.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"c7271019cbe209844cca8826be137418-ssl-df"
age: 4131
x-content-type-options: nosniff
cf-ray: 8e318f6e1de39750-FRA
x-nf-request-id: 01JCRKXR76V548YR471PJNQXZP
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 59cb0a1d87010ab3.css
www.zscaler.com/_next/static/css/ 19 KB
3 KB 57ms
52ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/59cb0a1d87010ab3.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c57780c294c4ac3bb4790f10f11ab4afe4e323819d2ae1278de9cc6b390fc7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9036d3452601bc5060c3cd0511dd853c-ssl-df"
age: 5352
x-content-type-options: nosniff
cf-ray: 8e318f6e1de49750-FRA
x-nf-request-id: 01JCRKXR7CJEX8Z911JFZNDMPH
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 d34fc117d4462dbb.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 46ms
41ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/d34fc117d4462dbb.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a2957e3f52eaaa2164c4c260e8a99bde-ssl-df"
age: 3021
x-content-type-options: nosniff
cf-ray: 8e318f6e1de59750-FRA
x-nf-request-id: 01JCRKXR7B5G0JQTM4XTBF763H
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 79723601f4599fef.css
www.zscaler.com/_next/static/css/ 25 KB
4 KB 51ms
46ms Stylesheet
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/79723601f4599fef.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7314898ae5841be613f65db4ba6b81d17e8a1e2a28cf11c40c0dbfcaa0a9859a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"1f3b977d0905b75df1322c5ebdb23b2d-ssl-df"
age: 6350
x-content-type-options: nosniff
cf-ray: 8e318f6e1de69750-FRA
x-nf-request-id: 01JCRKXR7G280CFDBQC0YT3BJ6
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1664.9b8ca4ecc35d08d1.js Show response
www.zscaler.com/_next/static/chunks/ 7 KB
3 KB 129ms
105ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1664.9b8ca4ecc35d08d1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1580616e3616a775919fdab1a24b8c5d33dfa8f0e2c4265c0ab192a5bc59c6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"efb7e61c18a537d82656b6e0dd119fbd-ssl-df"
age: 6234
x-content-type-options: nosniff
cf-ray: 8e318f6f2f3b9750-FRA
x-nf-request-id: 01JCRKXRCE0A4VB44MDDMNHQC5
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 4974.ad1d693e364e26bc.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 128ms
105ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/4974.ad1d693e364e26bc.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d33d260de9e5ffec7deee4515e781e0d89ecbeaee69050b7d5b7005028bb5e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"db64e9baec1313f5a92ebef6ac577099-ssl-df"
age: 2006
x-content-type-options: nosniff
cf-ray: 8e318f6f2f3c9750-FRA
x-nf-request-id: 01JCRKXRCP6MFN5GT0CX6P99CG
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 9955.16e6f491dc3d3e16.js Show response
www.zscaler.com/_next/static/chunks/ 8 KB
3 KB 1597ms
1574ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9955.16e6f491dc3d3e16.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8228a5e160e09389114752fef88589847b2a2925c2ad447a2a0d1346a154feea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4b29d5b2672ed34edb353d2997a1f1d7-ssl-df"
age: 2
x-content-type-options: nosniff
cf-ray: 8e318f6f2f3f9750-FRA
x-nf-request-id: 01JCRKXRCS4JM32DD3DGVVEKSN
date: Fri, 15 Nov 2024 19:13:46 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1151.0f7ca30a25f2c8e3.js Show response
www.zscaler.com/_next/static/chunks/ 605 B
435 B 267ms
245ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1151.0f7ca30a25f2c8e3.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

997fddba8851c6cdf1a13ee986e9ffa6b750afc46ee4809b2642d1f70a496706

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"cd53f1d74d232601f2dfaffc8b12f256-ssl"
age: 5648
x-content-type-options: nosniff
cf-ray: 8e318f6f2f409750-FRA
x-nf-request-id: 01JCRKXRCZ8C2F1M767ENVJSGJ
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 9017.74505813881349e1.js Show response
www.zscaler.com/_next/static/chunks/ 115 KB
37 KB 98ms
75ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9017.74505813881349e1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b87b2d30bb74bfe1d30f849caa9318b5c9f2df4216324c4c91e5c301284a50e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a83096a536225490fad1253c28b4bca6-ssl-df"
age: 6380
x-content-type-options: nosniff
cf-ray: 8e318f6f2f439750-FRA
x-nf-request-id: 01JCRKXRCGZKZ9RX26XZCZNB4S
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1732.5012f37f5ab7b0c8.js Show response
www.zscaler.com/_next/static/chunks/ 4 KB
2 KB 129ms
108ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1732.5012f37f5ab7b0c8.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e95b3816c967bdd21a6fd5b39e1a0d4190558ea29c3fc301df3cd049ee5b3a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"183e1fe66b759c6ab8b4e8f5215d8b57-ssl-df"
age: 6194
x-content-type-options: nosniff
cf-ray: 8e318f6f2f449750-FRA
x-nf-request-id: 01JCRKXRCRVS9NVJGNGM7WNHWE
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 7526.2a7c0172ebdd27ea.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 52ms
31ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7526.2a7c0172ebdd27ea.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55bb56299447bf3276bebf85f43c48b77d0e3bfdfbb6e4b278140d2ce971861

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"baa0680f097c1caa266889b2586630f0-ssl-df"
age: 3406
x-content-type-options: nosniff
cf-ray: 8e318f6f2f469750-FRA
x-nf-request-id: 01JCRKXRCB6YEG76BGZY4M8MKH
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 9328.ffe81042b943e268.js Show response
www.zscaler.com/_next/static/chunks/ 7 KB
3 KB 96ms
75ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9328.ffe81042b943e268.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5aaf7b9640925e4c588a8aa3a603f77889102f1b367db3becd44acbc5fe3ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"8e4e91507e70f9fcd3d09fdd2fb16046-ssl-df"
age: 5299
x-content-type-options: nosniff
cf-ray: 8e318f6f2f489750-FRA
x-nf-request-id: 01JCRKXRCGV6VAGD7N92TSKBJQ
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 938.dd59828e1962ef9a.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 96ms
75ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/938.dd59828e1962ef9a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c35f6dd3b0ba20509d10536d6ecb201aa8e4ec53720402c566210f6fc5119770

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a96638234cca20ac23e68f5847269f66-ssl-df"
age: 6230
x-content-type-options: nosniff
cf-ray: 8e318f6f2f4a9750-FRA
x-nf-request-id: 01JCRKXRCHRWB7ZQXCWZJYMP9S
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2120.64fc614677bbd5be.js Show response
www.zscaler.com/_next/static/chunks/ 43 KB
14 KB 249ms
228ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2120.64fc614677bbd5be.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22ca106a193dc17be7610da7fc7741b5359ed66f384db88792d75b093cecb434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"df1d4b68ee7c3638c204d3718b81c065-ssl-df"
age: 6490
x-content-type-options: nosniff
cf-ray: 8e318f6f2f4b9750-FRA
x-nf-request-id: 01JCRKXRCHR897V29SSWBSXDK2
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 webpack-b9b7dbedcb67bdf6.js Show response
www.zscaler.com/_next/static/chunks/ 12 KB
6 KB 121ms
100ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/webpack-b9b7dbedcb67bdf6.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

baa54e57ca6d1ee88f6e7af2f6083b9712ee80c264a44f9fcbbf78324c49bdae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"03755dbb7c13f1bc8d54c7669439610d-ssl-df"
age: 6815
x-content-type-options: nosniff
cf-ray: 8e318f6f2f4c9750-FRA
x-nf-request-id: 01JCRKXRCK19N2BZYM98ZPJEKS
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 framework-a71af9b1c76f668e.js Show response
www.zscaler.com/_next/static/chunks/ 137 KB
45 KB 95ms
74ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/framework-a71af9b1c76f668e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95574fc190611a6573178d07fb4e40ff98d224fb735648d76faafa20ae6dfbf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"22e6ceed8b1f05efe6213626eb3b2956-ssl-df"
age: 6804
x-content-type-options: nosniff
cf-ray: 8e318f6f2f4f9750-FRA
x-nf-request-id: 01JCRKXRCH98R69NHWZCR0FRGX
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main-8dadffc346739bd9.js Show response
www.zscaler.com/_next/static/chunks/ 111 KB
33 KB 122ms
101ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f0b15a1afaad3090fcd15f3b85c16f3cd72b58498d099ceda1500749ba0e611

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"f70bb75530f65ad946ebe64c4c5c7271-ssl-df"
age: 6804
x-content-type-options: nosniff
cf-ray: 8e318f6f2f509750-FRA
x-nf-request-id: 01JCRKXRCJ2R9D4QCQ8TFV8X6R
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _app-09d5e490ccf0a541.js Show response
www.zscaler.com/_next/static/chunks/pages/ 421 KB
136 KB 94ms
74ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/_app-09d5e490ccf0a541.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bae94c589b683231965e3dcea110716c7fe147396fe2f08509c33d3bd1dcde74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"eae39d15298812ff22932cb17759b39c-ssl-df"
age: 6814
x-content-type-options: nosniff
cf-ray: 8e318f6f2f529750-FRA
x-nf-request-id: 01JCRKXRCFSVA38BY192Y45RG7
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2635-846f40232fe95cc5.js Show response
www.zscaler.com/_next/static/chunks/ 207 KB
56 KB 243ms
223ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2635-846f40232fe95cc5.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ebb64cfb1007ee817bc11299a7a829dfe574d6a1ae4389056b23fbb7d0e1863

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"5e02bd735da1b9b792d5f676af7dcab0-ssl-df"
age: 6220
x-content-type-options: nosniff
cf-ray: 8e318f6f2f539750-FRA
x-nf-request-id: 01JCRKXRCK2CV6JFMT599N4ZXH
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 3137-eef5947276778551.js Show response
www.zscaler.com/_next/static/chunks/ 136 KB
38 KB 93ms
73ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/3137-eef5947276778551.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f34dcf4b0199f8e65fb814e549773b31ac54998d949e166432362f35e5cf4ece

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"afbdd3d4922908132dbe45ee55655638-ssl-df"
age: 6545
x-content-type-options: nosniff
cf-ray: 8e318f6f2f559750-FRA
x-nf-request-id: 01JCRKXRCDCM0EMPGQHSENMX89
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5603-7ce929a51c1b654d.js Show response
www.zscaler.com/_next/static/chunks/ 60 KB
18 KB 131ms
110ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/5603-7ce929a51c1b654d.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43518ad5e9480fd46ee80f9770332825df2b362ab61bf1c89899e123cce57a20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"88e83308b47a2b6dab533038c9b48e63-ssl-df"
age: 6478
x-content-type-options: nosniff
cf-ray: 8e318f6f2f569750-FRA
x-nf-request-id: 01JCRKXRCQQNHBBS5868WSNP85
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 7780-56c7808eee70649a.js Show response
www.zscaler.com/_next/static/chunks/ 143 KB
32 KB 95ms
75ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7780-56c7808eee70649a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57ae477b775a6f54e96d07ab9082be5dd226fb846d449f0f9c4c1db184191cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"42cce43eb2034b908b9c02430fd45907-ssl-df"
age: 5485
x-content-type-options: nosniff
cf-ray: 8e318f6f2f599750-FRA
x-nf-request-id: 01JCRKXRCHMXGGEAW570QR7070
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 %5B...slug%5D-b25522ec12435b15.js Show response
www.zscaler.com/_next/static/chunks/pages/blogs/ 3 KB
1 KB 51ms
31ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/blogs/%5B...slug%5D-b25522ec12435b15.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10ea16568bacd19b61f099d4bbf1ed540d6b41ad3c6f82be806e84cfb333bbe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"3d5439b449da79a198591c9aa6dcbf20-ssl-df"
age: 321
x-content-type-options: nosniff
cf-ray: 8e318f6f2f5a9750-FRA
x-nf-request-id: 01JCRKXRCEP33WCBJFKG009QRD
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _buildManifest.js Show response
www.zscaler.com/_next/static/hOEw6jUR5oOKW-gEIocs-/ 3 KB
1 KB 130ms
110ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/hOEw6jUR5oOKW-gEIocs-/_buildManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f688bb3d3be3f9b7071b4ee128ddc62eb4ba469d6b5fd550634d4f833b0a8680

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9179eddb73683122b3daf6e5f4f6f100-ssl-df"
age: 6796
x-content-type-options: nosniff
cf-ray: 8e318f6f2f5b9750-FRA
x-nf-request-id: 01JCRKXRCVB3JWF13W4EQ3732F
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _ssgManifest.js Show response
www.zscaler.com/_next/static/hOEw6jUR5oOKW-gEIocs-/ 449 B
290 B 93ms
73ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/hOEw6jUR5oOKW-gEIocs-/_ssgManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"d483bd250a3ef832dcda9d330b187d08-ssl"
age: 6488
x-content-type-options: nosniff
cf-ray: 8e318f6f3f5d9750-FRA
x-nf-request-id: 01JCRKXRCG9NCVY9W5H92J6XA8
date: Fri, 15 Nov 2024 19:13:44 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 email-decode.min.js Show response
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
830 B 30ms
19ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"673379cd-4d7"
x-content-type-options: nosniff
cf-ray: 8e318f6f3f609750-FRA
expires: Sun, 17 Nov 2024 19:13:44 GMT
date: Fri, 15 Nov 2024 19:13:44 GMT
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 15:52:45 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: DENY

GET
H2 200 image
www.zscaler.com/_next/ 5 KB
5 KB 178ms
86ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FGartner-report.png&w=256&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f0ce935f23a1a787a427daf4fd07dd3a394d6ad5b0f4dc74238c76125061f80

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 5685
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:44 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 17:38:59 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f7008439750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4948
x-nf-request-id: 01JCRKXRGMBXTS5RF6N5Z06BEH
cache-status: "Netlify Edge"; hit
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 10 KB
10 KB 179ms
87ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FCxo-revolutionaries.png&w=384&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

945881686d0a47eee9946902d92626dbfab4570d3c5fab2cb7c6e3343ee01f5c

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 7399
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:44 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 17:10:25 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f7008459750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10336
x-nf-request-id: 01JCRKXRGMRTXDBNGX4BN0TFRR
cache-status: "Netlify Edge"; hit
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 4 KB
4 KB 181ms
89ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=%2Fassets%2Fimages%2Fdefault-avatar.png&w=96&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09ffe1ebce8835c9b4d8232b59214200e95e6c2d2a3d67aba4d3f578051cd3a8

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 6802
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 17:20:25 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy
cache-control: public,max-age=0,must-revalidate
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f7008469750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3824
x-nf-request-id: 01JCRKXRGMSM40XEXTQ2AV82Q7
cache-status: "Netlify Edge"; fwd=stale
server: cloudflare

GET
H2 200 figure_1_4.png
cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/ 22 KB
22 KB 759ms
607ms Image
image/png 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/figure_1_4.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b225337bd396bb87276810ec413c3de46e99b433c96f5fd06656d933241c33da

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-cache-status: REVALIDATED
etag: "cfDwWp4QVrinqoesYyaib4hhIo1gWqs-rDoNB_ezzVDw"
cf-bgj: imgq:0,h2pri
cf-resized: internal=ok/r q=0 n=77+283 c=0+0 v=2024.10.6 l=22779 f=false
warning: cf-images 299 "cache-control is too restrictive", cf-images 299 "original is 55877B smaller"
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: image/png
last-modified: Mon, 12 Feb 2024 17:19:53 GMT
vary: Accept, Accept-Encoding
priority: u=4;i=?0,cf-chb=(58;u=5;i=?0)
strict-transport-security: max-age=31536000; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=300
via: varnish
cf-ray: 8e318f7098d89750-FRA
accept-ranges: bytes
content-length: 22779
server: cloudflare

GET
H2 200 figure_2_4.png
cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/ 10 KB
10 KB 453ms
303ms Image
image/png 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/figure_2_4.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e3cec700ecb1cba4decf672b883f04af33604b56647b56e05c4c1a65847e93d

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-cache-status: REVALIDATED
etag: "cfq9lyqFa_iO6Gau8SaGN6Do7W1gWqs-rDoNB_ezzVDw"
cf-bgj: imgq:0,h2pri
cf-resized: internal=ok/r q=0 n=87+259 c=0+142 v=2024.10.6 l=9839 f=false
warning: cf-images 299 "cache-control is too restrictive", cf-images 299 "original is 15856B smaller"
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: image/png
last-modified: Mon, 12 Feb 2024 17:22:27 GMT
vary: Accept, Accept-Encoding
priority: u=4;i=?0,cf-chb=(58;u=5;i=?0)
strict-transport-security: max-age=31536000; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=300
via: varnish
cf-ray: 8e318f7098da9750-FRA
accept-ranges: bytes
content-length: 9839
server: cloudflare

GET
H2 200 3e894970-e3e9-4783-85e9-7c38eedbfbbf.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/ 6 KB
2 KB 176ms
46ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/3e894970-e3e9-4783-85e9-7c38eedbfbbf.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ab49fd90ca814517ecccd0199152e764e8fcb16e0fd6ed91358d3aea88f753f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: HpD+28GsI57ANX5weGb5dA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD0587A2851D9C
age: 14495
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 16 Nov 2024 19:13:45 GMT
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: application/json
last-modified: Fri, 15 Nov 2024 15:10:26 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: ae1bfc41-701e-008b-1e70-372854000000
cf-ray: 8e318f70afe43a79-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1854
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
303 B 100ms
30ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8e318f716ef8d25a-FRA
access-control-allow-origin: *
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/ 457 KB
111 KB 30ms
29ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: Mq8sWt7aN99kE/VZ97+T8Q==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C88D357E6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 62451
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 02:45:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d1f3b68d-701e-006e-42a7-293aa3000000
cf-ray: 8e318f71a80335ec-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 113760
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b08f-7aea-8e5a-bfde3f6faa6f/ 106 KB
21 KB 51ms
50ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b08f-7aea-8e5a-bfde3f6faa6f/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

afdc88d38f1c87857f891d0d770251122d7e390e16288d1a94231a305f7faf90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: enqwnbKn3RnpxWTSjiTfkg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD05874009E6AC
age: 14494
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 16 Nov 2024 19:13:45 GMT
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: application/json
last-modified: Fri, 15 Nov 2024 15:07:40 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 5fbebc98-101e-00df-2d70-37c2de000000
cf-ray: 8e318f71f8ec3a79-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21621
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 13 KB
3 KB 20ms
19ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: RGlYb2KBTfdkPpxIxwwu0g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C8519203B
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 39972
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 02:44:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 19d25ec3-c01e-0038-3699-1fd2d3000000
cf-ray: 8e318f72697a3a79-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3003
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 5 KB
2 KB 26ms
26ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: fyGpUoUy0eZkGUgUg6MkZA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C86295E6C
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 40363
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 02:44:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: c7b4c099-501e-0079-2499-1ffac0000000
cf-ray: 8e318f72697c3a79-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1738
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 24 KB
4 KB 24ms
24ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c496fcbe60fec78dc1b86a9136644d9a97cae20df32be3e9a4a62ce7bd0e6a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status: unlocked
cf-bgj: minify
cf-cache-status: HIT
x-ms-version: 2009-09-19
age: 39987
content-encoding: gzip
x-content-type-options: nosniff
cf-polished: origSize=24745
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: text/css
last-modified: Wed, 16 Oct 2024 02:45:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 4801ab97-b01e-0073-6598-1fe349000000
cf-ray: 8e318f72697d3a79-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 zscaler-variation-icon-white.png
cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/018e5a48-f85f-7774-95d7-08faa6aa3c7b/12ee0f04-1958-4b33-a1d4-12aaee5a0f25/ 1 KB
2 KB 28ms
28ms Image
image/png 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/018e5a48-f85f-7774-95d7-08faa6aa3c7b/12ee0f04-1958-4b33-a1d4-12aaee5a0f25/zscaler-variation-icon-white.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce4e274c5793e7cd62cb67e2630278ef4a470b4baa35cb3b42e145717faed336

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: AjwaatmEihRgIitZTQhd5w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DC4977B36FCFB2
age: 83036
cf-cache-status: HIT
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:45 GMT
content-type: image/png
last-modified: Thu, 21 Mar 2024 07:22:44 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 11b1ed99-101e-008a-538e-7b6232000000
cf-ray: 8e318f7369e235ec-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1448
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 7763.d758ee891eda7402.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
723 B 25ms
25ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7763.d758ee891eda7402.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b9b7dbedcb67bdf6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"0500e040eba5ed9e5d82333085bd8bd7-ssl-df"
age: 6435
x-content-type-options: nosniff
cf-ray: 8e318f794b259750-FRA
x-nf-request-id: 01JCRKXSYXGPR3TNSGY6KCBRVP
date: Fri, 15 Nov 2024 19:13:46 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5551.c4fb596d5a66633e.js Show response
www.zscaler.com/_next/static/chunks/ 1000 B
712 B 22ms
21ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/5551.c4fb596d5a66633e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b9b7dbedcb67bdf6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"b43ee5b23a7cf90ba2dca725f4930f2a-ssl"
age: 6541
x-content-type-options: nosniff
cf-ray: 8e318f794b269750-FRA
x-nf-request-id: 01JCRKXSYSXXD1XRXTRXWHEC26
date: Fri, 15 Nov 2024 19:13:46 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 6023.ccb3fff03c4fa91a.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
747 B 19ms
18ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6023.ccb3fff03c4fa91a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b9b7dbedcb67bdf6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"39ccbb757c413d78d0f9a1a8014d51bb-ssl-df"
age: 6081
x-content-type-options: nosniff
cf-ray: 8e318f794b289750-FRA
x-nf-request-id: 01JCRKXSYTMA8BWPRQA93T1NM6
date: Fri, 15 Nov 2024 19:13:46 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 790.d7dc94c2ef6f512f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
897 B 24ms
24ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/790.d7dc94c2ef6f512f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b9b7dbedcb67bdf6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"6ff1ada259784a3388a9c23908ebebdc-ssl-df"
age: 6434
x-content-type-options: nosniff
cf-ray: 8e318f794b2a9750-FRA
x-nf-request-id: 01JCRKXSYXGZWB2KC5X0N9KKMD
date: Fri, 15 Nov 2024 19:13:46 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6831.3072668993ea221f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
725 B 31ms
31ms Script
application/javascript 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6831.3072668993ea221f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b9b7dbedcb67bdf6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7c416a32791e45716f8ef3dec7caa745-ssl-df"
age: 6797
x-content-type-options: nosniff
cf-ray: 8e318f794b2d9750-FRA
x-nf-request-id: 01JCRKXSZ23MX7JW3TPJEMJF7C
date: Fri, 15 Nov 2024 19:13:46 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ 199 KB
67 KB 709ms
31ms Script
application/x-javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "2f419be-31b73-6265f10c8a9b2"
age: 5486
x-content-type-options: nosniff
cf-ray: 8e318f7e6a36d2fa-FRA
expires: Fri, 15 Nov 2024 23:13:47 GMT
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: application/x-javascript
last-modified: Fri, 08 Nov 2024 04:20:05 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 414 KB
130 KB 465ms
43ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b664f678fe0b8fe9fe9da7a51977b258df5d04a09f57068cbde65e48db8d58ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 15 Nov 2024 19:13:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 15 Nov 2024 18:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 132503
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 image
www.zscaler.com/_next/ 20 KB
20 KB 663ms
662ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2F----category-images%2FantiVirus%2Fzscaler-blog-antivirus-4%25402x_0.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03e5ad9078ac2743c1a71b9bf1f8b61c1682f78f142aa8d0ec63d4b42c9f77ea

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 2
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 19:13:47 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f7a6c999750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20171
x-nf-request-id: 01JCRKXT4DWAXJVR4R5SCKSQBB
cache-status: "Netlify Edge"; fwd=miss
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 55 KB
55 KB 707ms
707ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fblog-tile-img-700x467-generic-code.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c27a7c526472e28e86e6ddffb1ab014c73fecaff290dce62b86d1896a88e97eb

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 2
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 19:13:47 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f7a6c9c9750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56164
x-nf-request-id: 01JCRKXT4FX8R8YG277ZFTK159
cache-status: "Netlify Edge"; fwd=miss
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 31 KB
32 KB 650ms
650ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2F----category-images%2Fbotnets%2Fzscaler-blog-botnets-1%25402x.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35f7f766216b5d4b77d11c9556216ea6dca0c02cb480af3f8e37425aa55199d8

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 2
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 19:13:47 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f7a7c9e9750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 32068
x-nf-request-id: 01JCRKXT4FNQ21PVPY058P8DB0
cache-status: "Netlify Edge"; fwd=miss
server: cloudflare

GET
H2 200 3af0ea8ee1d54b3f.css Show response
www.zscaler.com/_next/static/css/ 80 KB
117 B 20ms
20ms Fetch
text/css 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/3af0ea8ee1d54b3f.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7a807c808a7b103144313c0e6c26f870-ssl-df"
age: 6814
x-content-type-options: nosniff
cf-ray: 8e318f7a7ca39750-FRA
x-nf-request-id: 01JCRKXT4GE1D6GJDK9MB24N5C
date: Fri, 15 Nov 2024 19:13:46 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 215 KB
216 KB 1079ms
1079ms Image
image/avif 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fblog-tile-img-700x467-ransomware.jpg&w=1920&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee854e0f94d3a28c8d68a2d25586e453969668db0e27d665cb7509b2d9f50b35

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

cf-cache-status: DYNAMIC
age: 2
x-content-type-options: nosniff
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: image/avif
last-modified: Fri, 15 Nov 2024 19:13:47 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8e318f7b6dbe9750-FRA
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 220602
x-nf-request-id: 01JCRKXT9B3VZTXFVKFVE1FFA1
cache-status: "Netlify Edge"; fwd=miss
server: cloudflare

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 506ms
65ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Content-Encoding: gzip
ETag: "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595"
Connection: keep-alive
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 741
Date: Fri, 15 Nov 2024 19:13:47 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 13 Nov 2024 02:44:39 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 6934ae2b-4c76-4229-97d0-8f637b004b88.js Show response
j.6sc.co/j/ 4 KB
2 KB 471ms
165ms Script
application/javascript 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a2-17-100-193.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
etag: "afb8c61166e7f50fe6d7ab7b6377733c"
x-amz-version-id: uLuCr1hhLpJjZt0sFSB89FSJa4YqIrE7
expires: Fri, 15 Nov 2024 19:43:47 GMT
x-amz-cf-id: DYhFrF06827J9UT1kkCdaREo6d83MvX2kn0NqXyjgXcKI-jjjxwLPw==
date: Fri, 15 Nov 2024 19:13:47 GMT
last-modified: Tue, 02 May 2023 17:36:47 GMT
vary: Accept-Encoding
content-type: application/javascript
x-amz-meta-content-type: application/json
cache-control: private, max-age=1800
accept-ranges: bytes
content-length: 1178
x-amz-cf-pop: FRA60-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 1395e54b70b06b444656a2f40c135374.js Show response
ob.iseaskies.com/i/ 108 KB
40 KB 398ms
10ms Script
text/javascript 2600:9000:223e:4600:c:d449:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:4600:c:d449:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Caddy /
Resource Hash: a823f4600a0d01fec7ea9cbf3c51ecf0238645becac9f0bfe80a0c604fad8fbe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: "1affc-jNNGqwExtshRS5FV47RILrUrALE"
age: 28372
via: 1.1 94328d2509009edc0657f5c786a93e42.cloudfront.net (CloudFront)
expires: Fri, 15 Nov 2024 23:20:55 GMT
x-cache: Hit from cloudfront
content-length: 40435
x-amz-cf-id: 5vezDAF7Ar_WSj5FaSoI8v5f_DVS6o35InkJkycPiK4y4RaQH7b2gw==
date: Fri, 15 Nov 2024 11:20:59 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: Caddy
x-amz-cf-pop: FRA56-P4

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 6 KB
2 KB 86ms
69ms Script
application/javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=7971&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&callback=jQuery371039036688286914334_1731698027360&_=1731698027361
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81b35fad2af07ca2044d0ea9b54bc6e88d6505c85325adcf895a095266ef941f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-ray: 8e318f817ae1d2fa-FRA
cached: true
content-encoding: gzip
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 6 KB
2 KB 80ms
63ms Script
application/javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=1944&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&callback=jQuery371039036688286914334_1731698027362&_=1731698027363
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 261a2d85754b155a377a9d4424d16506ab458e29af3282f096f6b5db2c31530b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-ray: 8e318f817ae7d2fa-FRA
cached: true
content-encoding: gzip
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 21ms
20ms Script
application/javascript 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111bb"
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 22:13:47 GMT
accept-ranges: bytes
content-length: 18819
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 15ms
14ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Sun, 23 Feb 2025 19:13:47 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Fri, 15 Nov 2024 19:13:47 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 ct Show response
obs.iseaskies.com/ 4 KB
2 KB 899ms
150ms Script
text/javascript 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/ct?id=60409&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1731698028245&hl=2&op=0&ag=4155436659&rand=04608990106666786755660711028955240017406156709470256586715674786899722700510815720006&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDIzNTFdLFsiYWJuY2giLDY2XSxbLTEyLCJudWxsIl0sWy0xOCwiWzAsMCwwLDFdIl0sWy0zMywiLSJdLFstNDksIi0iXSxbLTUyLCItIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwidHdpdHRlcjp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiXX0iXSxbLTIxLCItIl0sWy0zMiwiMiJdLFstMzYsIltcIjQvM1wiLFwiNC8zXCJdIl0sWy01OCwiLSJdLFstNjAsMjA3XSxbLTYxLCJ7XCJ3Z3NsXCI6XCI0O3BhY2tlZF80eDhfaW50ZWdlcl9kb3RfcHJvZHVjdDt1bnJlc3RyaWN0ZWRfcG9pbnRlcl9wYXJhbWV0ZXJzO3BvaW50ZXJfY29tcG9zaXRlX2FjY2VzcztyZWFkb25seV9hbmRfcmVhZHdyaXRlX3N0b3JhZ2VfdGV4dHVyZXM7XCIsXCJwY2ZcIjpcImJncmE4dW5vcm1cIn0iXSxbLTcxLCJhMDExMDAxMDEwMDEwMDEwMTAwMDEwMTAwMTExMTEwMTAwMDAxMCJdLFszNywiWzMzMTYyMjQwNDksZnVuY3Rpb24obmV3VmFsdWUpIHtcbiAgICAgICAgICAgICAgYWRkQ29udGVudFdpbmRvd1Byb3h5KHRoaXMpXG4gICAgICAgICAgICAgIC8vIFJlc2V0IHByb3BlcnR5LCB0aGUgaG9vayBpcyBvbmx5IG5lZWRlZCBvbmNlXG4gICAgICAgICAgICAgIE9iamVjdC5kZWZpbmVQcm9wZXJ0eShpZnJhbWUsICdzcmNkb2MnLCB7XG4gICAgICAgICAgICAgICAgY29uZmlndXJhYmxlOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB3cml0YWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgdmFsdWU6IF9zcmNkb2NcbiAgICAgICAgICAgICAgfSlcbiAgICAgICAgICAgICAgX2lmcmFtZS5zcmNkb2MgPSBuZXdWYWx1ZVxuICAgICAgICAgICAgfV0iXSxbLTUsIi0iXSxbLTI5LCItIl0sWy0zOSwiW1wiMjAwMzAxMDdcIiwyLFwiR2Vja29cIixcIk5ldHNjYXBlXCIsXCJNb3ppbGxhXCIsbnVsbCxudWxsLHRydWUsOCxmYWxzZSxudWxsLDUsdHJ1ZSx0cnVlLG51bGwsMCx0cnVlLHRydWVdIl0sWy00NiwiMCJdLFstNDcsIkV1cm9wZS9CZXJsaW4sZGUsbGF0bixncmVnb3J5Il0sWy01NywiV0UwWlYxeE9jVmhYWFZWY1N4Y0ZXbFpVU1V4TlhGMEhHV0pZU2hsWVNVbFZRR1FaRVZ4UFdGVVpXRTBaQlZoWFZsZEFWRlpNU2djWkVRTU9Bd2dNQ1FvSkFSQVZHUVZZVjFaWFFGUldURW9IQXdnQkF3b0pFQlZZVFJsNFMwdFlRQmRQWEJrUlVVMU5TVW9ERmhaV1d4ZFFTbHhZU2xKUVhFb1hXbFpVRmxBV0NBb0FERndNRFZzT0NWc0pEMXNORFEwUERBOVlDMThOQ1ZvSUNnd0tEZzBYVTBvRENBTVBBUXNNQ1JBVldFMFpTeGtSVVUxTlNVb0RGaFpXV3hkUVNseFlTbEpRWEVvWFdsWlVGbEFXQ0FvQURGd01EVnNPQ1ZzSkQxc05EUTBQREE5WUMxOE5DVm9JQ2d3S0RnMFhVMG9EQ0FNT0N3QUlDUkE9Il0sWy01OSwiZGVmYXVsdCJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstMzgsImksLTEsLTEsMCwwLDAsMCwyMiwxNDUsNDc1MCwtMSwwLDUwODAuNyw1MDgwLjcsODEzOCw4MTM4Il0sWy00MCwiMzMiXSxbLTQxLCItIl0sWy00NCwiMCwwLDAsNSJdLFstNjQsIlswLFwiXCIsW11dIl0sWy02NiwiZ2VvbG9jYXRpb24sY2h1YWZ1bGx2ZXJzaW9ubGlzdCxjcm9zc29yaWdpbmlzb2xhdGVkLHNjcmVlbndha2Vsb2NrLHB1YmxpY2tleWNyZWRlbnRpYWxzZ2V0LHNoYXJlZHN0b3JhZ2VzZWxlY3R1cmwsY2h1YWFyY2gsY29tcHV0ZXByZXNzdXJlLGNocHJlZmVyc3JlZHVjZWR0cmFuc3BhcmVuY3ksdXNiLGNoc2F2ZWRhdGEscHVibGlja2V5Y3JlZGVudGlhbHNjcmVhdGUsc2hhcmVkc3RvcmFnZSxydW5hZGF1Y3Rpb24sY2h1YWZvcm1mYWN0b3JzLGNoZG93bmxpbmssb3RwY3JlZGVudGlhbHMscGF5bWVudCxjaHVhLGNodWFtb2RlbCxjaGVjdCxhdXRvcGxheSxjYW1lcmEscHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxhY2NlbGVyb21ldGVyLGNodWFwbGF0Zm9ybXZlcnNpb24saWRsZWRldGVjdGlvbixwcml2YXRlYWdncmVnYXRpb24saW50ZXJlc3Rjb2hvcnQsY2h2aWV3cG9ydGhlaWdodCxsb2NhbGZvbnRzLGNodWFwbGF0Zm9ybSxtaWRpLGNodWFmdWxsdmVyc2lvbix4cnNwYXRpYWx0cmFja2luZyxjbGlwYm9hcmRyZWFkLGdhbWVwYWQsZGlzcGxheWNhcHR1cmUsa2V5Ym9hcmRtYXAsam9pbmFkaW50ZXJlc3Rncm91cCxjaHdpZHRoLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24sYnJvd3Npbmd0b3BpY3MsZW5jcnlwdGVkbWVkaWEsZ3lyb3Njb3BlLHNlcmlhbCxjaHJ0dCxjaHVhbW9iaWxlLHdpbmRvd21hbmFnZW1lbnQsdW5sb2FkLGNoZHByLGNocHJlZmVyc2NvbG9yc2NoZW1lLGNodWF3b3c2NCxhdHRyaWJ1dGlvbnJlcG9ydGluZyxmdWxsc2NyZWVuLGlkZW50aXR5Y3JlZGVudGlhbHNnZXQscHJpdmF0ZXN0YXRldG9rZW5yZWRlbXB0aW9uLGhpZCxjaHVhYml0bmVzcyxzdG9yYWdlYWNjZXNzLHN5bmN4aHIsY2hkZXZpY2VtZW1vcnksY2h2aWV3cG9ydHdpZHRoLHBpY3R1cmVpbnBpY3R1cmUsbWFnbmV0b21ldGVyLGNsaXBib2FyZHdyaXRlLG1pY3JvcGhvbmUiXSxbLTE3LCIxMiJdLFstNDMsIjAwMDAwMDAxMDEwMDAwMDEwMDExMTAxMTAwMTAxMTAxMDAwMDAxMCJdLFstNDgsIjAsMCJdLFstNTYsImxhbmRzY2FwZS1wcmltYXJ5Il0sWy02OCwiLSJdLFstOCwiLSJdLFstOSwiKyJdLFstMTQsIi0iXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy02OSwiTGludXggeDg2XzY0fEdvb2dsZSBJbmMufDh8MTJ8fDAiXSxbLTEsIi0iXSxbLTYsIi0iXSxbLTcsIi0iXSxbLTE1LCItIl0sWy01MCwiLSJdLFstNzAsIi0iXSxbMTIsIntcImN0eFwiOlwid2ViZ2xcIixcInZcIjpcImludGVsIGluYy5cIixcInJcIjpcImludGVsIGlyaXMgb3BlbmdsIGVuZ2luZVwiLFwic2x2XCI6XCJ3ZWJnbCBnbHNsIGVzIDEuMCAob3BlbmdsIGVzIGdsc2wgZXMgMS4wIGNocm9taXVtKVwiLFwiZ3ZlclwiOlwid2ViZ2wgMS4wIChvcGVuZ2wgZXMgMi4wIGNocm9taXVtKVwiLFwiZ3ZlblwiOlwid2Via2l0XCIsXCJiZW5cIjo1OCxcIndnbFwiOjEsXCJncmVuXCI6XCJ3ZWJraXQgd2ViZ2xcIixcInNlZlwiOjE5MzA4MjAyNzksXCJzZWNcIjpcIlwifSJdLFstNCwiLSJdLFstMTAsIi0iXSxbLTEzLCItIl0sWy0yMCwiLSJdLFstMjMsIisiXSxbLTI0LCJbXCJzYXlzd2hvXCIsMCwxLDEsMV0iXSxbLTI3LCJbMCwxMCwwLFwiNGdcIixudWxsXSJdLFstMzEsImZhbHNlIl0sWy0yLCIyNyxlQUhXWDEvZjNxekN2Ymt1eW1Rd2dsSWFGM3BJc2dJSWpTUSs4aUtncUkwb3NJQWlwRkVFUVJJa1VnZEVRUXBVb0pTQXRDQXFTSDlHeXk3WldaK2VyL2QrZTkyYndzQ1NELzFlIl0sWy0yOCwiZW4tVVMsZW4iXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTM0LCItIl0sWy00NSwiNjIwLDY3NywwLDAsMCw1NjIsMCwwLDY0OCwwLDAsMCwwLDAsMCwwLDAsMCwwLDY4NCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCJdLFstNjIsIjgwIl0sWy0xNiwiMCJdLFstMjUsIi0iXSxbLTM1LCJbMTczMTY5ODAyODEyOSwtMV0iXSxbLTM3LCItMTQ0LTY2LTE4MC0iXSxbLTYzLCIwIl0sWy02NSwiLSJdLFstNjcsIjI1MzIzMTI4ODg6MTAxIl0sWyJibmNoIiw0NjldLFstMTksIls4MjAsODIwLDgyMCw4MjAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyODUsMTYwMCwxMjAwLDAsMCwwLDAsXCItXCIsXCItXCIsMTYwMCwxMjAwXSJdLFstMjYsIntcInRqaHNcIjozNjQ5MDk0OSxcInVqaHNcIjoyNDkxNzExNyxcImpoc2xcIjo0Mjk0NzA1MTUyfSJdLFstNDIsIjE3MjQyOTc2NTMiXSxbLTUxLCItIl0sWy01MywiMTAwIl0sWy01NCwie1wiaFwiOltcIl8zXCIsXCIyODcyODk5MzIwXCJdLFwiZFwiOltdLFwiYlwiOltcIjExNzY3Mjg3ODdcIixcIjM0OTc4MTAxNzVcIixcIl8xXCIsXCIyNDI1NjY1NDAxXCIsXCJfMlwiLFwiMjgzMjYwMjY3OFwiXSxcInNcIjoxfSJdLFstNTUsIjEiXSxbImRkYiIsIjAsMjcsMSwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMSw5LDAsMCwwLDAsMSwwLDIsMTE4LDAsMCwwLDEsMSwwLDAsMCwwLDAsMCwxLDIsMCw2LDAsMCwwLDAsMCwwLDEwMCwxLDAsMSwxIl0sWyJjYiIsIjEsMCwwLDAsMCwwLDAsMCwwLDIsMCwwLDgwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMywwLDAsOCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAiXV0%3D&dep=0&pre=0&sdd=%7B%7D&cri=FsI69dctKc&pto=8502&ver=62&gac=-&mei=&ap=&fe=1&duid=1.1731698028.3jUhFhrEzWsps3Ls&suid=1.1731698028.EiY4XdcBrQFns5Q5&tuid=1.1731698028.hXW3XjGTmd1uGFrG&fbc=-&gtm=WyJPbmVUcnVzdExvYWRlZCIsIk9wdGFub25Mb2FkZWQiLCJPbmVUcnVzdEdyb3Vwc1VwZGF0ZWQiLCJHQTQgSUQgUmVjb3JkaW5nIl0%3D&it=92%2C7555%2C466&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 9d18143645e91de108ffb121188c2c7a953863d26396e4c068f1bb66b6ea1f7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: https://www.zscaler.com
content-encoding: gzip
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
content-length: 1323
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: text/javascript

GET
H2 200 forms2.css
info.zscaler.com/js/forms2/css/ 13 KB
3 KB 26ms
26ms Stylesheet
text/css 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "301120-3437-62370c030d900"
age: 4151
x-content-type-options: nosniff
cf-ray: 8e318f84abc6d2fa-FRA
expires: Fri, 15 Nov 2024 23:13:48 GMT
accept-ranges: bytes
content-length: 2623
date: Fri, 15 Nov 2024 19:13:48 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-round.css
info.zscaler.com/js/forms2/css/ 4 KB
1 KB 22ms
22ms Stylesheet
text/css 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2-theme-round.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "30111f-e46-62370c030d900"
age: 3117
x-content-type-options: nosniff
cf-ray: 8e318f84abc9d2fa-FRA
expires: Fri, 15 Nov 2024 23:13:48 GMT
accept-ranges: bytes
content-length: 968
date: Fri, 15 Nov 2024 19:13:48 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

POST
H/1.1 200
OK visitWebPage
306-zej-256.mktoresp.com/webevents/ 2 B
318 B 1129ms
161ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://306-zej-256.mktoresp.com/webevents/visitWebPage?_mchNc=1731698028296&_mchCn=&_mchId=306-ZEJ-256&_mchTk=_mch-zscaler.com-1731698028294-89388&_mchHo=www.zscaler.com&_mchPo=&_mchRu=%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: d4dde372-3a76-4c7b-8c1f-d3fb9d310954
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Fri, 15 Nov 2024 19:13:49 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
701 B 532ms
16ms XHR
application/json 37.252.171.85
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.85 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.76; 45.141.152.76; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
an-x-request-uuid: 3abf8cb2-a154-43e7-bf28-fa44fe1c28c7
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 15 Nov 2024 19:13:48 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 / Show response
c.6sc.co/ 7 B
193 B 20ms
10ms XHR
text/html 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a2-17-100-193.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.zscaler.com
content-length: 7
date: Fri, 15 Nov 2024 19:13:48 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 36 B
337 B 705ms
4ms XHR
text/html 2a02:26f0:7100::210:180
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:180 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 4b5b233efc13af1d7d466b9126be6f750931c3ab9d3599e071cb857ce9e777b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:ac8:20:3a00:1011:2825:819b:4f64
expires: Fri, 15 Nov 2024 19:13:49 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1731698028326_34603388_139913917_22_886_6_673_219";dur=1
access-control-allow-origin: https://www.zscaler.com
content-length: 36
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: text/html
vary: Origin

GET
H2 200 XDFrame Show response
info.zscaler.com/index.php/form/ Frame 5528 2 KB
864 B 114ms
113ms Document
text/html 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/index.php/form/XDFrame

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8e318f86a93cd2fa-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 15 Nov 2024 19:13:48 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 760 B
663 B 135ms
44ms XHR
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 65a1c8e40f97a72622872b33032cc16d98c9cd61c56d1fe897a0ded9a7375dc4

Request headers

Authorization: Token 1dc729230d6b8d19bab5e6236d81f60c4dca0823
X-6s-CustomID: WebTag 6934ae2b-4c76-4229-97d0-8f637b004b88
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.zscaler.com
content-length: 404
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: application/json
vary: Origin, Accept-Encoding

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 166ms
162ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:48 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:48 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 140ms
136ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22ab9750bca4342498694e239e304dd3a9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%221dc729230d6b8d19bab5e6236d81f60c4dca0823%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%226934ae2b-4c76-4229-97d0-8f637b004b88%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:48 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:48 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ Frame 5528 199 KB
0 1ms
1ms Script
application/x-javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://info.zscaler.com/index.php/form/XDFrame

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "2f419be-31b73-6265f10c8a9b2"
age: 5486
x-content-type-options: nosniff
cf-ray: 8e318f7e6a36d2fa-FRA
expires: Fri, 15 Nov 2024 23:13:47 GMT
date: Fri, 15 Nov 2024 19:13:47 GMT
content-type: application/x-javascript
last-modified: Fri, 08 Nov 2024 04:20:05 GMT
vary: Accept-Encoding
server: cloudflare

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 560ms
20ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.zscaler.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Fri, 15 Nov 2024 19:13:49 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 172ms
133ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:49 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 426 KB
136 KB 90ms
32ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f51c3b469e87b11ddb8c27ce81a3a941662fc336b22ed4f5679c90411b5824fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 15 Nov 2024 19:13:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 138795
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 423 KB
135 KB 89ms
32ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9146531647283ab46088fb325e0ed812b4cc44eed1e1dd56077fb8054fff38eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 15 Nov 2024 19:13:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 137457
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 308ms
87ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-8BFyxLU1' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-8BFyxLU1' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=23, mss=1232, tbw=4718, tp=14, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: mxX9KothZl/PQeA2QX0Zkyk6DzcMTHvOW9bPtcDE3ds7j7IJFm/wLVcg/ruegAxmK1HSCPTS55G6VDnQ82GNjg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62152
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 584ms
129ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A1BC3471B3BB4B4F9227BCAC86FC63C7 Ref B: FRAEDGE1714 Ref C: 2024-11-15T19:13:49Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Fri, 15 Nov 2024 19:13:48 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 301 KB
100 KB 122ms
56ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

80380354079df2ec016ff46d7e03505c5f8004f8abf4629e2309f5d027ebf33c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 15 Nov 2024 19:13:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 15 Nov 2024 18:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 102692
x-xss-protection: 0
server: Google Tag Manager

GET
H3

200

/
www.google.de/pagead/1p-conversion/812494211/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWx...
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxA...
https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAg...

42 B
64 B

364ms
39ms

Image
image/gif

2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbEC&pscrd=IhMIguqk74XfiQMVroyDBx1Fjh0SMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7d7-SvVjdrWIHKgA1rZc1wL9p_oAPQXg&random=3668328243&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 15 Nov 2024 19:13:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.de/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=595458597&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbEC&pscrd=IhMIguqk74XfiQMVroyDBx1Fjh0SMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7d7-SvVjdrWIHKgA1rZc1wL9p_oAPQXg&random=3668328243&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 15 Nov 2024 19:13:50 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 tc_imp.gif
obs.iseaskies.com/tracker/ 43 B
79 B 161ms
139ms Image
image/gif 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.iseaskies.com/tracker/tc_imp.gif?e=37dfbd8ee84e001269efc13ce24788949225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5811896d2e17071a10acf9f29f67418ad28952796c4dfe717306d26adf33920c300271c150055b66065cc6ed3e4f77be26bb25cb43e2913bf05365ac5c7e721bda53ee46f49486df3dbb2907fe7fcaaa5d6f8b0e3942781693d25462f160b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c44ca4825b6a3e5aa22a76da50eda7cf54a6863c89777256e1d0cd71ed0d906f50732e690b73255015ab2fb523c9bdc05457f54065258fcd135700e5fe6a5142c93aaf62e8ee04572032cbbc5f4c2c935e7c2db59ec489f5e2c7edfaacff4e43e82d5e36a93335f84fd98281144fe356ffbc51560ead0a87c860eac10b6861ec047d9d36d9a6d279c9b22da6198cefab6cdb3f11338ae6bf2fbb9234e2bfb94248efe01e0141a54954309da8dcec8cff18021853bd79fa29873f867342483692c978490446ad6a774bf0ce9845b9d7aa33270607def16923b9c89ee79bfc7609452a79fdbd87683550435ac0f4f1d3e483e9fec4593059a8c8764fdcd2bbd872f9adabab03d9fb7e358766e8ff91e1c9bf7471a03feacba74f762cfab58afa07da060b26fc4158d4386ec65984435eebccc74232d375259570542f4a5f538c008a5585c5f3baee63c83c14d52bac18ba8b67edffff8eec4a4bdfb204c3ff25b85b45f728243651bd77f5c716cf678b37719c2ebc57f8b60d7258cb72dcdb80f91670e2120017d0f9dc0e4d83b67548605469dd0c5a6b3cd5a1983b1be7f8ad2757bd9ce0f3a69fbfcc54475f27ed14d9508e2219a15d8c915f1b232e09396d1c2223a99b87916c811e5cdf3a86adf7e280446d1311742bbb15e91ed13c9989dc15ccd858f2d7b6e2eba55ff56d817d3f737d537222453266f3ba403da933947b871c1a0f634dfc6458c767bb149144b9c808b7d3eb325f4cb67ac45461256ae796cd4bddd03a64b2cd8c14ab3d5dde392168b19045e4aa126610bc3ce6e09ed65b8a0d3278ecffe5a083eb060230b0dd30510bbc8fc12108c70318ec2c553c3d7b9c64530fa6df9156056d05c7c3c8681164b8acaf189a1e146a328ac6dd62cdd9d5d87beba393def9a529bc8eba0cef2cadf65019eec2c559b368e18c41d98a459f4909e8e28ecd1c7f2ad1727d7b4ab&cri=FsI69dctKc&ts=1067&cb=1731698029312
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
date: Fri, 15 Nov 2024 19:13:49 GMT
pragma: no-cache
content-type: image/gif

GET 3f70d82e-38e9-434d-bb20-45d3d0854107
https://www.zscaler.com/ Frame 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 348ms
185ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A48%20GMT%22%2C%22timeSpent%22%3A%221100%22%2C%22totalTimeSpent%22%3A%221100%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:49 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET 966f04dc-f5d1-4c0e-84ab-6b2fac79b099
https://www.zscaler.com/ Frame 0
0

GET
H2 200 295018432.js Show response
bat.bing.com/p/action/ 362 B
421 B 48ms
46ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/295018432.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1fc671898ad010ba690b89d83f8c813088990a6018b21818096387fe4a2c8e67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4A74D0B4E4C047759DFCA2246D6B6EDF Ref B: FRAEDGE1714 Ref C: 2024-11-15T19:13:49Z
x-cache: CONFIG_NOCACHE
date: Fri, 15 Nov 2024 19:13:49 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 1778897272132032 Show response
connect.facebook.net/signals/config/ 81 KB
16 KB 95ms
85ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1778897272132032?v=2.9.177&r=stable&domain=www.zscaler.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

27754e8a910d21e1a15a25268dbb46740ed89090918892bff8e1fdee93d273f0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-e0eHBKNY' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 15 Nov 2024 19:13:50 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-e0eHBKNY' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=4, c=63, mss=1232, tbw=75614, tp=75, tpl=4, uplat=77, ullat=0
pragma: public
x-fb-debug: v9rGHkYmcSPvRHlXKoT9pT2fDXEOrXDdDRDmUtkExlBvbIlrxBupGI7MBJP2VqKblz7q1pQnaDsT02t4lSFN1g==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H3 200 collect
www.google.com/ccm/ 0
0 549ms
92ms Ping
text/plain 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&scrsrc=www.googletagmanager.com&frm=0&rnd=2131178986.1731698030&auid=2047689099.1731698030&npa=1&did=dYWJhMj&gdid=dYWJhMj&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&tft=1731698030187&tfd=10442&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/812494211/ 5 KB
3 KB 49ms
46ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/812494211/?random=1731698030222&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Pikabot%20Updates%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=2047689099.1731698030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f2.1e100.net

Software

cafe /

Resource Hash

1332b92c02565e6fa1ffe18a07fb35537fc06a2493fd38040b798af751a807b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2712
date: Fri, 15 Nov 2024 19:13:50 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
147 B 483ms
473ms XHR
application/json 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Fri, 15 Nov 2024 19:13:50 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 210 KB
76 KB 127ms
99ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c&gtm=45je4bc0v883639532za200zb71607006

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

587cd82a7eae4158c08774b7b970e62c941ee41cdcde9aed24b34735cd37608c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 15 Nov 2024 19:13:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:50 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 15 Nov 2024 18:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 77320
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 654ms
77ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je4bc0v883639532za200zb71607006&_p=1731698026579&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&gdid=dYWJhMj&cid=244263278.1731698031&ecid=287681738&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1731698030&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&dt=Pikabot%20Updates%20%7C%20ThreatLabz&en=CQ&_fv=1&_nsi=1&_ss=1&_ee=1&up.cq_category=bots&tfd=10890
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:51 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
554 B 654ms
51ms Ping
text/plain 2a00:1450:400c:c0d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-10SPJ4YJL9&cid=244263278.1731698031&gtm=45je4bc0v883639532za200zb71607006&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0d::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:51 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 645ms
110ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-10SPJ4YJL9&cid=244263278.1731698031&gtm=45je4bc0v883639532za200zb71607006&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&tag_exp=101925629~102067555~102067808~102077855&z=863555161

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 15 Nov 2024 19:13:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
16 B 383ms
178ms XHR
application/json 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Fri, 15 Nov 2024 19:13:50 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 278ms
75ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A49%20GMT%22%2C%22timeSpent%22%3A%221252%22%2C%22totalTimeSpent%22%3A%222352%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:50 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:50 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 368ms
32ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&rl=&if=false&ts=1731698030849&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12318&fbp=fb.1.1731698030777.82194423244932335&ler=empty&cdl=API_unavailable&it=1731698030084&coo=false&exp=f0&rqm=GET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=28, rtx=0, c=23, mss=1232, tbw=4666, tp=13, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 15 Nov 2024 19:13:51 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
192 B 519ms
182ms Image
image/png 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&rl=&if=false&ts=1731698030849&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12318&fbp=fb.1.1731698030777.82194423244932335&ler=empty&cdl=API_unavailable&it=1731698030084&coo=false&exp=f0&rqm=FGET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7437586411778413689"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 15 Nov 2024 19:13:51 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: oxoo4c/5/iSBqEir11z8lKAba8wczDpkmJrBnhNdtFYCd5x6lB0uKzRgSGL+UlG/YZn734cKS6Es8g146+rwqg==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7437586411778413689", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=22, rtx=0, c=24, mss=1232, tbw=5082, tp=17, tpl=0, uplat=166, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
DATA 200
OK truncated
/ Frame D79E 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D79E 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3

200

/
www.google.de/pagead/1p-conversion/812494211/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l...
https://www.google.com/pagead/1p-conversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma...
https://www.google.de/pagead/1p-conversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=...

42 B
64 B

66ms
65ms

Image
image/gif

2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Pikabot%20Updates%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=2047689099.1731698030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECSidldmVudC1zb3VyY2UsIHRyaWdnZXI7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIwvjS74XfiQMV2ZuDBx3JwB_-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoQUlnUF9idVFZUXZLX0x1Y0NDLS1oY0VpMEFEajg5YUpnR19tTGJNc0t4N25UOGpZUENFQkVNMEZlYUxwYXRlRmRvVkc4OXJDY3Q1OXpwbnBFak5Fcw&is_vtc=1&cid=CAQSKQCa7L7dTwBxYIMG2I-qA6FbJ_D_KBWKLfVRw5_e3REv0x46juGxA8gY&random=3518684371&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 15 Nov 2024 19:13:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.de/pagead/1p-conversion/812494211/?random=1050430147&cv=11&fst=1731698030222&bg=ffffff&guid=ON&async=1&gtm=45be4bc0v882815967za200zb71607006&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Pikabot%20Updates%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=1&pscdl=noapi&auid=2047689099.1731698030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fdr=CA&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECSidldmVudC1zb3VyY2UsIHRyaWdnZXI7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIwvjS74XfiQMV2ZuDBx3JwB_-MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoQUlnUF9idVFZUXZLX0x1Y0NDLS1oY0VpMEFEajg5YUpnR19tTGJNc0t4N25UOGpZUENFQkVNMEZlYUxwYXRlRmRvVkc4OXJDY3Q1OXpwbnBFak5Fcw&is_vtc=1&cid=CAQSKQCa7L7dTwBxYIMG2I-qA6FbJ_D_KBWKLfVRw5_e3REv0x46juGxA8gY&random=3518684371&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 15 Nov 2024 19:13:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 304ms
87ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c&gtm=45je4bc0v883639532za200zb71607006

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
age: 6224
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:30:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 17:30:07 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 256ms
155ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A50%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223352%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:51 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:51 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
419 B 53ms
28ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2049940022&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&ul=de-de&de=UTF-8&dt=Pikabot%20Updates%20%7C%20ThreatLabz&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1785249120&gjid=1944286406&cid=244263278.1731698031&tid=UA-6177009-1&_gid=540830588.1731698032&_r=1&gtm=457e4bc0z8883639532za200zb883639532&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&did=dYWJhMj&gdid=dYWJhMj&jsscut=1&npa=1&z=28977308

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.zscaler.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 19:13:51 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 791ms
53ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
etag: W/"b2877da906a3216c4f3fc4030b205e54"
age: 61398
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: s-9FXtvHQLHJZ-8sRcjA26qnzgvBHAJuwvugGAFxjPuFpQrxHPdACw==
date: Fri, 15 Nov 2024 19:13:52 GMT
content-type: application/javascript
last-modified: Thu, 18 Jul 2024 08:13:46 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
via: 1.1 f2c65205154aaf89a2c7bbc8fe8fdaba.cloudfront.net (CloudFront)
cf-ray: 8e318fa03e61dcc9-FRA
x-amz-cf-pop: FRA56-P4
server: cloudflare

GET
H2 200 117186981.js Show response
cdn.intellimize.co/snippet/ 498 KB
107 KB 933ms
131ms Script
application/javascript 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.intellimize.co/snippet/117186981.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6203321f027c43e405d21759df167f78bc8f0da05d4de4552bed1ba561c03df1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=0, must-revalidate
content-encoding: gzip
etag: "04d58424603f8fd301f13304ae47941b6--gzip"
age: 0
x-timer: S1731698033.735191,VS0,VE106
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 109566
date: Fri, 15 Nov 2024 19:13:52 GMT
content-type: application/javascript;charset=utf-8
x-served-by: cache-fra-eddf8230057-FRA
x-cache-hits: 0
vary: Intellimize-Namespace, Intellimize-StatusModule, Accept-Encoding

GET
H2 200 1395e54b70b06b444656a2f40c135374.js Show response
ob.iseaskies.com/i/ 108 KB
0 1ms
1ms Script
text/javascript 2600:9000:223e:4600:c:d449:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:4600:c:d449:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Caddy /
Resource Hash: a823f4600a0d01fec7ea9cbf3c51ecf0238645becac9f0bfe80a0c604fad8fbe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: "1affc-jNNGqwExtshRS5FV47RILrUrALE"
age: 28372
via: 1.1 94328d2509009edc0657f5c786a93e42.cloudfront.net (CloudFront)
expires: Fri, 15 Nov 2024 23:20:55 GMT
x-cache: Hit from cloudfront
content-length: 40435
x-amz-cf-id: 5vezDAF7Ar_WSj5FaSoI8v5f_DVS6o35InkJkycPiK4y4RaQH7b2gw==
date: Fri, 15 Nov 2024 11:20:59 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: Caddy
x-amz-cf-pop: FRA56-P4

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 148ms
145ms XHR
application/json 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Fri, 15 Nov 2024 19:13:52 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
16 B 122ms
112ms XHR
application/json 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Fri, 15 Nov 2024 19:13:52 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H2 200 favicon-32x32.ico
www.zscaler.com/favicons/ 4 KB
993 B 181ms
131ms Other
image/vnd.microsoft.icon 2606:4700:4400::ac40:99eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/favicons/favicon-32x32.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99eb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"875ed25f85201afbfc383f6b833f32c5-ssl"
age: 4908
x-content-type-options: nosniff
cf-ray: 8e318fa039b99750-FRA
x-nf-request-id: 01JCRKY01GDN561AJ7JV0PD4HZ
date: Fri, 15 Nov 2024 19:13:52 GMT
cache-status: "Netlify Edge"; hit
content-type: image/vnd.microsoft.icon
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 142ms
129ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A51%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224354%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:52 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:52 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
615 B 213ms
190ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 02380678c6c824fc24c5117258d0a727799aac0b2260c6a95f073bb5e65918d4

Request headers

Authorization: Bearer e6609b6e9a1669129391
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"cb-GtA1S70wJlBH4oZM4rZ2QGtk5dA"
apigw-requestid: BTWJvi5qvHcEMqw=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: eSz0oMnJFvI_mjptshlcxc6GiyT1yBbTUnZaK0QbYp_rMW6PX4w9Xw==
date: Fri, 15 Nov 2024 19:13:53 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
server-timing: cfExtPri
via: 1.1 2ba7b49ec4c4de4e67297e603c89a5e4.cloudfront.net (CloudFront)
cf-ray: 8e318fa2ef349975-FRA
access-control-allow-origin: https://www.zscaler.com
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
server: cloudflare

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 323ms
261ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.zscaler.com
alt-svc: h3=":443"; ma=86400
apigw-requestid: BTWJsjWVPHcEMRA=
cf-cache-status: DYNAMIC
cf-ray: 8e318fa0fde99975-FRA
date: Fri, 15 Nov 2024 19:13:52 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 2ba7b49ec4c4de4e67297e603c89a5e4.cloudfront.net (CloudFront)
x-amz-cf-id: lMvMD8uNGFZpVtmkKz0xAS5uOPU1ZhCjrL3LXQoeaKUuTmbXl_GOuA==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 storage.html
117186981.intellimizeio.com/ Frame 1270 0
0 751ms
43ms Document
text/html 54.217.115.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://117186981.intellimizeio.com/storage.html

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.217.115.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-217-115-217.eu-west-1.compute.amazonaws.com

Software

/ Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 5628
content-type: text/html; charset=utf-8
date: Fri, 15 Nov 2024 19:13:54 GMT
etag: W/"15fc-Uk1A5QrccB7iUltcerqKsVx8Uo0"
strict-transport-security: max-age=15552000; includeSubDomains
x-powered-by: Express

POST
H2 200 117186981 Show response
api.intellimize.co/context-v2/ 562 B
641 B 961ms
144ms Fetch
application/json 108.128.50.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/context-v2/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.50.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-108-128-50-9.eu-west-1.compute.amazonaws.com

Software

Resource Hash

3dc094258b5e5f680af474920312046361259df371bab7607772a18081ca9e76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Fri, 15 Nov 2024 19:13:54 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 49 KB
15 KB 767ms
47ms Script
application/javascript 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=A2aW0Q==, md5=JRurSHzL3UB0yE1Wjm0Zqg==
cf-cache-status: DYNAMIC
etag: W/"251bab487ccbdd4074c84d568e6d19aa"
age: 382
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Fri, 15 Nov 2024 20:07:32 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 50634
server-timing: cfExtPri
date: Fri, 15 Nov 2024 19:13:54 GMT
content-type: application/javascript
last-modified: Wed, 06 Nov 2024 05:44:23 GMT
priority: u=3,i=?0
x-guploader-uploadid: AFiumC5W9Dw2O12EZWov6Lj0XU5UT_YfxybYU5QIob--LeUEYsMGp5R8X-bIZQsrweSaYWaRWwk4y9PmeQ
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
cf-ray: 8e318faacd75d2b6-FRA
x-goog-generation: 1730871862939881
server: cloudflare

GET
H3 200 / Show response
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ 3 KB
2 KB 205ms
192ms Fetch
text/javascript 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e12a431a5adcb8454555daf4f969ac89290aebeffc44ef660d8b968dcd0a8052

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: aabc7c03b5f9171e43c71731698033
_vtok: NDUuMTQxLjE1Mi43Ng==
visited-url: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Referer: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 15 Nov 2024 19:13:54 GMT
content-type: text/javascript
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8e318fa9aba2dc48-FRA
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 270ms
209ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A52%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225356%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:53 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:53 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ Frame 0
0 525ms
143ms Preflight
text/html 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.zscaler.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8e318fa8af4ad2ab-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 15 Nov 2024 19:13:54 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 109ms
107ms XHR
application/json 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Fri, 15 Nov 2024 19:13:54 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
BLOB 200
OK 80e39f4b-44c1-4d3d-91f5-426b9acb2fc9 Show response
https://www.zscaler.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.zscaler.com/80e39f4b-44c1-4d3d-91f5-426b9acb2fc9
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e12a431a5adcb8454555daf4f969ac89290aebeffc44ef660d8b968dcd0a8052

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/javascript
Content-Length: 3033

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 321 B
649 B 191ms
186ms Fetch
application/json 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Authorization: bearer 370c892e688e1744cd312ed1426b3a
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"141-mLq6O+j3ZcyvZxAx4AvrvpOh24w"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 15 Nov 2024 19:13:54 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8e318fad9e09dc48-FRA
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

POST
H2 200 user-alias Show response
log.intellimize.co/ 3 B
316 B 928ms
167ms Fetch
application/json 35.161.58.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/user-alias

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.161.58.191 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-161-58-191.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Fri, 15 Nov 2024 19:13:55 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 117186981 Show response
api.intellimize.co/prediction/ 68 B
379 B 176ms
42ms Fetch
application/json 108.128.50.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/prediction/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.50.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-108-128-50-9.eu-west-1.compute.amazonaws.com

Software

Resource Hash

d064f6003b9cd71a4e9f1f3196cb158216adddb5865482a9d7e4a3c8ac6c43f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Fri, 15 Nov 2024 19:13:54 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 195ms
98ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A53%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%226360%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:54 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:54 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 276ms
165ms Preflight
text/html 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.zscaler.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8e318fac8af1d2ab-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 15 Nov 2024 19:13:54 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H2 200 logger
log.intellimize.co/ 3 B
325 B 601ms
166ms Ping
application/json 35.161.58.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.161.58.191 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-161-58-191.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Fri, 15 Nov 2024 19:13:55 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 logger
log.intellimize.co/ 3 B
315 B 598ms
166ms Ping
application/json 35.161.58.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.161.58.191 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-161-58-191.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Fri, 15 Nov 2024 19:13:55 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 164ms
163ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227361%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:55 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:55 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 156ms
156ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228362%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:56 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:56 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 app.js Show response
acsbapp.com/apps/app/dist/js/ 384 KB
115 KB 233ms
172ms Script
application/javascript 2606:4700:10::ac43:b9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://acsbapp.com/apps/app/dist/js/app.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b9b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 97eb81b3243714173224c1cdb3d41f8eea3ebb9f49408fdc472932d6f0aabfd9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-goog-metageneration: 3
access-control-expose-headers: *
x-goog-hash: crc32c=rhD+kg==, md5=a+Qa86nH09hkhFT62uw0aQ==
cf-cache-status: REVALIDATED
etag: W/"6be41af3a9c7d3d8648454fadaec3469"
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Sat, 15 Nov 2025 19:13:57 GMT
x-goog-stored-content-length: 392795
date: Fri, 15 Nov 2024 19:13:57 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 14 Nov 2024 16:22:48 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY3EmiPLR41v4VRgJLbEL5cvHIlJIklhVvSMsd8tl_Nh1ROd_nBFLMeAHEoDUorb8LNas3oAFWfffg
cache-control: public, max-age=300, must-revalidate
x-goog-storage-class: STANDARD
cf-ray: 8e318fbb4e64372d-FRA
access-control-allow-origin: *
x-goog-generation: 1731601368459687
server: cloudflare

GET
H2 200 config.json Show response
cdn.acsbapp.com/config/zscaler.com/ 163 B
696 B 249ms
135ms Fetch
application/json 2606:4700:10::ac43:b9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.acsbapp.com/config/zscaler.com/config.json?page=%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT
Requested by: Host: acsbapp.com
URL: https://acsbapp.com/apps/app/dist/js/app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b9b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e20594a73ecbdcb15e351a97aaed3f415fd3872c916d10a452bcb23b6329a06f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cr7nwQ==, md5=Gryic5fvx+CKF1M8SFqLWQ==
cf-cache-status: MISS
etag: W/"1abca27397efc7e08a17533c485a8b59"
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Sat, 15 Nov 2025 19:13:59 GMT
x-goog-stored-content-length: 163
date: Fri, 15 Nov 2024 19:13:59 GMT
content-type: application/json
last-modified: Tue, 20 Feb 2024 16:21:37 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY3jcK8L0VXlB7kvNPqmtlmrZJ1WvHc4RPB5NJNJxhfYSnFlV9MIKWRK4VbKgfth7TBxWw
cache-control: public, max-age=300, must-revalidate
x-goog-storage-class: STANDARD
cf-ray: 8e318fc8a8839f2c-FRA
access-control-allow-origin: *
x-goog-generation: 1708446097855326
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 96ms
96ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A59%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A56%20GMT%22%2C%22timeSpent%22%3A%222388%22%2C%22totalTimeSpent%22%3A%2210750%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:13:59 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:13:59 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

POST mon
obs.iseaskies.com/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 96ms
95ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A14%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A13%3A59%20GMT%22%2C%22timeSpent%22%3A%221021%22%2C%22totalTimeSpent%22%3A%2211771%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:14:00 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:14:00 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 221ms
220ms Image
image/gif 2.17.100.193
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A14%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A14%3A00%20GMT%22%2C%22timeSpent%22%3A%223004%22%2C%22totalTimeSpent%22%3A%2214775%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 15 Nov 2024 19:14:03 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 15 Nov 2024 19:14:03 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 167ms
107ms XHR
application/json 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Fri, 15 Nov 2024 19:14:04 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/3f70d82e-38e9-434d-bb20-45d3d0854107

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/966f04dc-f5d1-4c0e-84ab-6b2fac79b099

Domain: obs.iseaskies.com
URL: https://obs.iseaskies.com/mon

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=64b32908-299c-4bc6-8c4f-60a4ab8d31ef&session=782a160b-6bef-4b2e-8433-1ec3a7add7e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A14%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2015%20Nov%202024%2019%3A14%3A03%20GMT%22%2C%22timeSpent%22%3A%223000%22%2C%22totalTimeSpent%22%3A%2217775%22%7D&isIframe=false&m=%7B%22description%22%3A%22Updates%20to%20Pikabot%20bring%20less%20advanced%20string%20obfuscation%20and%20a%20modified%20network%20protocol%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Pikabot%20Updates%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&pageViewId=d7eb349c-d5b2-4950-8e98-af4f9ae28585&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3Aac8%3A20%3A3a00%3A1011%3A2825%3A819b%3A4f64&v=1.1.29

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.zscaler.com/	1970-01-21 09:47:14	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Fri+Nov+15+2024+20%3A13%3A45+GMT%2B0100+(Mitteleurop%C3%A4ische+Normalzeit)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&consentId=85673730-2810-4c74-9326-e199a03aabbf&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fd-evolution-PIKABOT&groups=C0001%3A1%2CC0005%3A0%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0&hosts=H36%3A1%2CH98%3A1%2CH141%3A1%2CH12%3A0%2CH144%3A0%2CH68%3A0%2CH145%3A0%2CH139%3A0%2CH31%3A0%2CH46%3A0%2CH76%3A0%2CH110%3A0%2CH185%3A0%2CH190%3A0%2CH191%3A0%2CH101%3A0%2CH152%3A0%2CH133%3A0%2CH8%3A0%2CH159%3A0%2CH104%3A0%2CH160%3A0%2CH105%3A0%2CH14%3A0%2CH149%3A0%2CH166%3A0%2CH17%3A0%2CH63%3A0%2CH174%3A0%2CH176%3A0%2CH177%3A0%2CH135%3A0%2CH179%3A0%2CH136%3A0%2CH182%3A0%2CH45%3A0%2CH33%3A0%2CH34%3A0%2CH187%3A0&genVendors=
.info.zscaler.com/	1970-01-21 01:01:39	Name: __cf_bm Value: QWJ0aDNSxJAO53MfXLp5CRhdJuCQemuDUk8TXVHskqA-1731698027-1.0.1.1-cUGhenLiJD7dDdGeaJ.YCYsCV4e.UKhZjeqAkxykotwIfYdVitobgMMQMhGzv5WfwbND2c9vLYNSIsuttmENng
.zscaler.com/	1970-01-21 03:13:02	Name: _cq_duid Value: 1.1731698028.3jUhFhrEzWsps3Ls
.zscaler.com/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1731698028.EiY4XdcBrQFns5Q5
.zscaler.com/	1970-01-21 10:37:38	Name: _mkto_trk Value: id:306-ZEJ-256&token:_mch-zscaler.com-1731698028294-89388
www.zscaler.com/	1970-01-21 10:37:38	Name: _gd_visitor Value: 64b32908-299c-4bc6-8c4f-60a4ab8d31ef
www.zscaler.com/	1970-01-21 01:01:52	Name: _gd_session Value: 782a160b-6bef-4b2e-8433-1ec3a7add7e9
info.zscaler.com/	1969-12-31 23:59:59	Name: BIGipServerabmweb-nginx-app_https Value: !hp6HpNKJRKmAH+/TY1tgvhyyRs2fV1giCiY6VRfsDTeelwmGxZJtZrzXUGLEWCJJpNxbsACT20TXfg==
.adnxs.com/	1970-01-21 10:37:38	Name: receive-cookie-deprecation Value: 1
www.zscaler.com/	1970-01-21 01:11:42	Name: _an_uid Value: 0
obs.iseaskies.com/	1970-01-21 09:05:28	Name: cg_uuid Value: 88a0eecf0942ea0ae807bb254c230ce0
.zscaler.com/	1970-01-21 03:11:14	Name: _gcl_au Value: 1.1.2047689099.1731698030
.zscaler.com/	1970-01-21 10:37:38	Name: _ga_10SPJ4YJL9 Value: GS1.1.1731698030.1.0.1731698030.60.0.287681738
.zscaler.com/	1970-01-21 01:03:04	Name: _uetsid Value: bf41d360a38511ef9975d5007fca76a3
.zscaler.com/	1970-01-21 10:23:14	Name: _uetvid Value: bf427e60a38511efa5eb0d06b91cc4ee
.zscaler.com/	1970-01-21 03:11:14	Name: _fbp Value: fb.1.1731698030777.82194423244932335
.doubleclick.net/	1970-01-21 10:23:14	Name: IDE Value: AHWqTUlpqL4WQMkVIXmD9HIZ5X_VFJsL4gNdrooYyU_sBsGgjrrfBw6oHEuGoKaW
.zscaler.com/	1970-01-21 10:37:38	Name: _ga Value: GA1.2.244263278.1731698031
.zscaler.com/	1970-01-21 01:03:04	Name: _gid Value: GA1.2.540830588.1731698032
.zscaler.com/	1970-01-21 01:01:38	Name: _gat_gtag_UA_6177009_1 Value: 1
.www.zscaler.com/	1970-01-21 09:47:14	Name: _zitok Value: aabc7c03b5f9171e43c71731698033
.zoominfo.com/	1970-01-21 01:01:39	Name: __cf_bm Value: y8dTU8ympN9RKdVTPaxuHIIWqOpwy5r4Iqip5B.8XNk-1731698034-1.0.1.1-pyyvSkyyfKa2O7SwjypoFjVPlMZ83PwKmmrG8Lcb429tEtR8jMXiOkgmHk70DOkm4.WDRvj34IzVNsc3Ieszaw
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: r_WJ_NhecSIlmwtyszp5uxRwu7l2gEyrNeRX.BarKm4-1731698034398-0.0.1.1-604800000

25 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT Message: [GroupMarkerNotSet(crbug.com/242999)!:A000191654080000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
worker	verbose	URL: blob:https://www.zscaler.com/3f70d82e-38e9-434d-bb20-45d3d0854107(Line 1) Message: Error
security	error	URL: https://www.googletagmanager.com/ Message: Refused to frame 'https://www.googletagmanager.com/' because it violates the following Content Security Policy directive: "frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com".
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4bc0v71607006za200(Line 452) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
javascript	warning	URL: https://www.zscaler.com/blogs/security-research/d-evolution-PIKABOT Message: The resource https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fblog-tile-img-700x467-ransomware.jpg&w=3840&q=75 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

117186981.intellimizeio.com
306-zej-256.mktoresp.com
acsbapp.com
api.intellimize.co
b.6sc.co
bat.bing.com
c.6sc.co
cdn.acsbapp.com
cdn.cookielaw.org
cdn.intellimize.co
cms.zscaler.com
connect.facebook.net
eps.6sc.co
geolocation.onetrust.com
googleads.g.doubleclick.net
info.zscaler.com
ipv6.6sc.co
j.6sc.co
js.zi-scripts.com
log.intellimize.co
munchkin.marketo.net
ob.iseaskies.com
obs.iseaskies.com
region1.analytics.google.com
secure.adnxs.com
stats.g.doubleclick.net
ws-assets.zoominfo.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.zscaler.com
b.6sc.co
obs.iseaskies.com
www.zscaler.com
104.17.71.206
104.18.37.212
108.128.50.9
151.101.194.132
172.217.16.194
192.28.144.124
2.17.100.193
2001:4860:4802:32::36
2600:1f18:e8a:cd02:882c:d916:bae1:7722
2600:9000:223e:4600:c:d449:2a40:93a1
2606:4700:10::ac43:b9b
2606:4700:4400::6812:2089
2606:4700:4400::ac40:99eb
2606:4700::6810:752b
2606:4700::6810:762b
2606:4700::6812:562a
2620:1ec:33:1::10
2a00:1450:4001:801::200e
2a00:1450:4001:806::2002
2a00:1450:4001:806::2004
2a00:1450:4001:80f::2003
2a00:1450:4001:813::2008
2a00:1450:400c:c0d::9b
2a02:26f0:7100::210:180
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
35.161.58.191
37.252.171.85
54.217.115.217
88.221.60.75
99.83.231.3
02380678c6c824fc24c5117258d0a727799aac0b2260c6a95f073bb5e65918d4
02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
03e5ad9078ac2743c1a71b9bf1f8b61c1682f78f142aa8d0ec63d4b42c9f77ea
04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747
09ffe1ebce8835c9b4d8232b59214200e95e6c2d2a3d67aba4d3f578051cd3a8
0c57780c294c4ac3bb4790f10f11ab4afe4e323819d2ae1278de9cc6b390fc7a
0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3
0e95b3816c967bdd21a6fd5b39e1a0d4190558ea29c3fc301df3cd049ee5b3a0
10ea16568bacd19b61f099d4bbf1ed540d6b41ad3c6f82be806e84cfb333bbe9
1332b92c02565e6fa1ffe18a07fb35537fc06a2493fd38040b798af751a807b2
13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5
1ab49fd90ca814517ecccd0199152e764e8fcb16e0fd6ed91358d3aea88f753f
1ebb64cfb1007ee817bc11299a7a829dfe574d6a1ae4389056b23fbb7d0e1863
1fc671898ad010ba690b89d83f8c813088990a6018b21818096387fe4a2c8e67
22ca106a193dc17be7610da7fc7741b5359ed66f384db88792d75b093cecb434
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
261a2d85754b155a377a9d4424d16506ab458e29af3282f096f6b5db2c31530b
27754e8a910d21e1a15a25268dbb46740ed89090918892bff8e1fdee93d273f0
29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175
2f0ce935f23a1a787a427daf4fd07dd3a394d6ad5b0f4dc74238c76125061f80
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
35f7f766216b5d4b77d11c9556216ea6dca0c02cb480af3f8e37425aa55199d8
3dc094258b5e5f680af474920312046361259df371bab7607772a18081ca9e76
42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c
43518ad5e9480fd46ee80f9770332825df2b362ab61bf1c89899e123cce57a20
43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f
4b5b233efc13af1d7d466b9126be6f750931c3ab9d3599e071cb857ce9e777b1
4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06
54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57ae477b775a6f54e96d07ab9082be5dd226fb846d449f0f9c4c1db184191cee
587cd82a7eae4158c08774b7b970e62c941ee41cdcde9aed24b34735cd37608c
5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640
6203321f027c43e405d21759df167f78bc8f0da05d4de4552bed1ba561c03df1
6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c
65a1c8e40f97a72622872b33032cc16d98c9cd61c56d1fe897a0ded9a7375dc4
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b87b2d30bb74bfe1d30f849caa9318b5c9f2df4216324c4c91e5c301284a50e
6c496fcbe60fec78dc1b86a9136644d9a97cae20df32be3e9a4a62ce7bd0e6a6
7314898ae5841be613f65db4ba6b81d17e8a1e2a28cf11c40c0dbfcaa0a9859a
7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c
7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7
7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff
7e3cec700ecb1cba4decf672b883f04af33604b56647b56e05c4c1a65847e93d
7f0b15a1afaad3090fcd15f3b85c16f3cd72b58498d099ceda1500749ba0e611
7f6d94f2c0cb031ee68a4125e2ec5bcda8c21d0187affabb22995d0e2a941e60
80380354079df2ec016ff46d7e03505c5f8004f8abf4629e2309f5d027ebf33c
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
81b35fad2af07ca2044d0ea9b54bc6e88d6505c85325adcf895a095266ef941f
8228a5e160e09389114752fef88589847b2a2925c2ad447a2a0d1346a154feea
89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140
89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723
8d33d260de9e5ffec7deee4515e781e0d89ecbeaee69050b7d5b7005028bb5e3
8f8c10f0ca1014d8cdfba696150e67da4dbb97885260f13276dd2284ec149ff0
9146531647283ab46088fb325e0ed812b4cc44eed1e1dd56077fb8054fff38eb
945881686d0a47eee9946902d92626dbfab4570d3c5fab2cb7c6e3343ee01f5c
95574fc190611a6573178d07fb4e40ff98d224fb735648d76faafa20ae6dfbf4
97eb81b3243714173224c1cdb3d41f8eea3ebb9f49408fdc472932d6f0aabfd9
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
997fddba8851c6cdf1a13ee986e9ffa6b750afc46ee4809b2642d1f70a496706
9d18143645e91de108ffb121188c2c7a953863d26396e4c068f1bb66b6ea1f7a
9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd
9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc
a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6
a823f4600a0d01fec7ea9cbf3c51ecf0238645becac9f0bfe80a0c604fad8fbe
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace
ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10
afdc88d38f1c87857f891d0d770251122d7e390e16288d1a94231a305f7faf90
b225337bd396bb87276810ec413c3de46e99b433c96f5fd06656d933241c33da
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
b664f678fe0b8fe9fe9da7a51977b258df5d04a09f57068cbde65e48db8d58ca
b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc
baa54e57ca6d1ee88f6e7af2f6083b9712ee80c264a44f9fcbbf78324c49bdae
bae94c589b683231965e3dcea110716c7fe147396fe2f08509c33d3bd1dcde74
beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac
c1580616e3616a775919fdab1a24b8c5d33dfa8f0e2c4265c0ab192a5bc59c6d
c27a7c526472e28e86e6ddffb1ab014c73fecaff290dce62b86d1896a88e97eb
c35f6dd3b0ba20509d10536d6ecb201aa8e4ec53720402c566210f6fc5119770
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce4e274c5793e7cd62cb67e2630278ef4a470b4baa35cb3b42e145717faed336
d04e3c8f040925ea84463c20dc7bfcafb5ccb461b9a4c484680ba09af30ca7ad
d064f6003b9cd71a4e9f1f3196cb158216adddb5865482a9d7e4a3c8ac6c43f2
d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f
d55bb56299447bf3276bebf85f43c48b77d0e3bfdfbb6e4b278140d2ce971861
d5aaf7b9640925e4c588a8aa3a603f77889102f1b367db3becd44acbc5fe3ee5
d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e12a431a5adcb8454555daf4f969ac89290aebeffc44ef660d8b968dcd0a8052
e20594a73ecbdcb15e351a97aaed3f415fd3872c916d10a452bcb23b6329a06f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2
e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
eddd884436be08bc6ecaff1ea001f0f68eea7fe12664000a6f3646e07961a061
ee854e0f94d3a28c8d68a2d25586e453969668db0e27d665cb7509b2d9f50b35
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f34dcf4b0199f8e65fb814e549773b31ac54998d949e166432362f35e5cf4ece
f51c3b469e87b11ddb8c27ce81a3a941662fc336b22ed4f5679c90411b5824fe
f5bf9e709edea93b24c7135cdc0dd210313fd00a76c4ce484cc9bd13f14add1c
f688bb3d3be3f9b7071b4ee128ddc62eb4ba469d6b5fd550634d4f833b0a8680
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.zscaler.com Open in urlscan Pro 2606:4700:4400::ac40:99eb Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

149 Requests

95 %HTTPS

61 %IPv6

22 Domains

35 Subdomains

31 IPs

5 Countries

2709 kBTransfer

7950 kBSize

23 Cookies

29 Outgoing links

Redirected requests

149 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.zscaler.com Open in urlscan Pro
2606:4700:4400::ac40:99eb Public Scan

Screenshot
Live screenshot

Full Image

149
Requests

95 %
HTTPS

61 %
IPv6

22
Domains

35
Subdomains

31
IPs

5
Countries

2709 kB
Transfer

7950 kB
Size

23
Cookies

149 HTTP transactions
2 data transactions