www.zscaler.com Open in urlscan Pro
2606:4700::6812:1d4a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Submission: On October 16 via api (October 16th 2024, 2:14:24 am UTC) from TR — Scanned from US

Summary HTTP 139 Redirects Links 48 Behaviour Indicators

Summary

This website contacted 33 IPs in 2 countries across 21 domains to perform 139 HTTP transactions. The main IP is 2606:4700::6812:1d4a, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com. The Cisco Umbrella rank of the primary domain is 69289.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 28th 2024. Valid for: a year.

This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
53	2606:4700::68... 2606:4700::6812:1d4a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:250... 2600:9000:250a:7c00:c:d449:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2607:f8b0:400... 2607:f8b0:400d:c03::61	15169 (GOOGLE) (GOOGLE)
1	151.101.2.132 151.101.2.132	54113 (FASTLY) (FASTLY)
5	2600:1f18:e8a... 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a	14618 (AMAZON-AES) (AMAZON-AES)
2	23.13.172.203 23.13.172.203	16625 (AKAMAI-AS) (AKAMAI-AS)
12	23.205.106.73 23.205.106.73	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.204.24.143 18.204.24.143	14618 (AMAZON-AES) (AMAZON-AES)
2	3.216.162.62 3.216.162.62	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f00... 2a03:2880:f003:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	172.217.197.156 172.217.197.156	15169 (GOOGLE) (GOOGLE)
2 3	2607:f8b0:400... 2607:f8b0:400d:c0f::9d	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:400d:c0c::63	15169 (GOOGLE) (GOOGLE)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	68.67.179.166 68.67.179.166	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:1408:ec0... 2600:1408:ec00:2e::1735:ba8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2607:f8b0:400... 2607:f8b0:400d:c0f::9a	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c0d::9d	15169 (GOOGLE) (GOOGLE)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f10... 2a03:2880:f103:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	35.81.243.85 35.81.243.85	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:400d:c09::8a	15169 (GOOGLE) (GOOGLE)
2	18.67.76.13 18.67.76.13	16509 (AMAZON-02) (AMAZON-02)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:762b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:752b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:cc	() ()
139	33

53 2606:4700::6812:1d4a (United States)

ASN13335 (CLOUDFLARENET, US)

www.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:250a:7c00:c:d449:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

ob.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:400d:c03::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

obs.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.13.172.203 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-13-172-203.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 23.205.106.73 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-205-106-73.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.204.24.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-204-24-143.compute-1.amazonaws.com

117186981.intellimizeio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.216.162.62 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-216-162-62.compute-1.amazonaws.com

api.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:100:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.197.156 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: qa-in-f156.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:400d:c0f::9d (Morganton, United States) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:400d:c0c::63 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

306-zej-256.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.179.166 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:ec00:2e::1735:ba8 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:400d:c0f::9a (Morganton, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c0d::9d (Morganton, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f103:181:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.81.243.85 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-243-85.us-west-2.compute.amazonaws.com

log.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c09::8a (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.67.76.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-76-13.iad89.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:762b (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:752b (United States)

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:cc (None, )

ASN- ()

acsbapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	zscaler.com www.zscaler.com — Cisco Umbrella Rank: 69289 info.zscaler.com — Cisco Umbrella Rank: 628703	1 MB
17	6sc.co j.6sc.co — Cisco Umbrella Rank: 5626 c.6sc.co — Cisco Umbrella Rank: 6951 ipv6.6sc.co — Cisco Umbrella Rank: 5794 b.6sc.co — Cisco Umbrella Rank: 3611 eps.6sc.co — Cisco Umbrella Rank: 11869 v.eps.6sc.co — Cisco Umbrella Rank: 16729	24 KB
8	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	207 KB
7	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 td.doubleclick.net — Cisco Umbrella Rank: 192 stats.g.doubleclick.net — Cisco Umbrella Rank: 136	3 KB
6	iseaskies.com ob.iseaskies.com — Cisco Umbrella Rank: 444422 obs.iseaskies.com — Cisco Umbrella Rank: 497603	42 KB
5	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4482 ws-assets.zoominfo.com — Cisco Umbrella Rank: 11155	30 KB
5	intellimize.co cdn.intellimize.co — Cisco Umbrella Rank: 37558 api.intellimize.co — Cisco Umbrella Rank: 33118 log.intellimize.co — Cisco Umbrella Rank: 32375	110 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	525 KB
4	google.com www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 147	192 B
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5671	4 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34	22 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	3 KB
2	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 89	3 KB
2	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	73 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3657	6 KB
1	acsbapp.com acsbapp.com	96 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 479	700 B
1	mktoresp.com 306-zej-256.mktoresp.com	318 B
1	intellimizeio.com 117186981.intellimizeio.com — Cisco Umbrella Rank: 822121
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	305 B
139	21

	Domain	Requested by
53	www.zscaler.com	www.zscaler.com js.zi-scripts.com
9	b.6sc.co	www.zscaler.com
8	cdn.cookielaw.org	www.zscaler.com cdn.cookielaw.org
7	info.zscaler.com	www.zscaler.com info.zscaler.com
5	obs.iseaskies.com	ob.iseaskies.com www.zscaler.com
5	www.googletagmanager.com	www.zscaler.com ob.iseaskies.com www.googletagmanager.com
4	ws.zoominfo.com	js.zi-scripts.com ws-assets.zoominfo.com
3	js.zi-scripts.com	www.zscaler.com js.zi-scripts.com
3	td.doubleclick.net	www.googletagmanager.com
3	www.google.com	www.zscaler.com
3	googleads.g.doubleclick.net	2 redirects www.googletagmanager.com
2	v.eps.6sc.co	j.6sc.co
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	log.intellimize.co	cdn.intellimize.co
2	www.facebook.com	www.zscaler.com
2	eps.6sc.co	j.6sc.co
2	www.googleadservices.com	1 redirects www.googletagmanager.com
2	bat.bing.com	ob.iseaskies.com bat.bing.com
2	connect.facebook.net	ob.iseaskies.com connect.facebook.net
2	api.intellimize.co	cdn.intellimize.co
2	j.6sc.co	www.zscaler.com j.6sc.co
2	munchkin.marketo.net	www.zscaler.com munchkin.marketo.net
1	acsbapp.com	www.zscaler.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	306-zej-256.mktoresp.com	munchkin.marketo.net
1	117186981.intellimizeio.com	cdn.intellimize.co
1	cdn.intellimize.co	www.zscaler.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	ob.iseaskies.com	www.zscaler.com
139	34

This site contains links to these domains. Also see Links.

Domain
threatlabz.zscaler.com
help.zscaler.com
admin.zscaler.net
admin.zscalerone.net
admin.zscalertwo.net
admin.zscalerthree.net
admin.zscalerbeta.net
admin.zscloud.net
admin.private.zscaler.com
admin.zpatwo.net
partners.zscaler.com
securitypreview.zscaler.com
testmydefenses.com
customer.zscaler.com
community.zscaler.com
ir.zscaler.com
www.facebook.com
twitter.com
www.linkedin.com
github.com
thewover.github.io
threatlibrary.zscaler.com
attack.mitre.org
www.twitter.com
www.youtube.com

Subject Issuer	Validity	Valid
www.zscaler.com DigiCert SHA2 Extended Validation Server CA	`2024-02-28` - `2025-02-23`	a year	crt.sh
*.iseaskies.com Amazon RSA 2048 M02	`2024-06-18` - `2025-07-18`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
info.zscaler.com WE1	`2024-09-07` - `2024-12-06`	3 months	crt.sh
*.google-analytics.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
cdn.intellimize.co R10	`2024-09-11` - `2024-12-10`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.intellimizeio.com Amazon RSA 2048 M03	`2024-09-24` - `2025-10-22`	a year	crt.sh
api.intellimize.co Amazon RSA 2048 M03	`2024-09-24` - `2025-10-22`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-25` - `2024-10-23`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.googleadservices.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
log.intellimize.co Amazon RSA 2048 M03	`2024-09-23` - `2025-10-22`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
zi-scripts.com WE1	`2024-09-22` - `2024-12-21`	3 months	crt.sh
zoominfo.com E5	`2024-10-12` - `2025-01-10`	3 months	crt.sh
acsbapp.com WE1	`2024-08-18` - `2024-11-16`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Frame ID: 2575899EE6CC48324CD5631ADFD3387B
Requests: 126 HTTP requests in this frame

Frame: https://117186981.intellimizeio.com/storage.html
Frame ID: 36F263A8F98DF6C1E1D856773BB16B01
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/812494211?random=1729044858274&cv=11&fst=1729044858274&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: 36958AEF29C745883608321DE981F047
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/812494211?random=1729044858331&cv=11&fst=1729044858331&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&gtm_ee=1&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0
Frame ID: BB81285A9F49C9201A32F48319D27842
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-10SPJ4YJL9&gacid=514359380.1729044858&gtm=45je4ae0v883639532za200zb71607006&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101529666~101686685&z=602196190
Frame ID: 60537BC2278DC3D66754D51E43586673
Requests: 1 HTTP requests in this frame

Frame: https://info.zscaler.com/index.php/form/XDFrame
Frame ID: 6C39B8E5C365E0A787D2C3C840AD17B9
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DarkVision RAT | ThreatLabz

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

139
Requests

95 %
HTTPS

59 %
IPv6

21
Domains

34
Subdomains

33
IPs

2
Countries

2351 kB
Transfer

7502 kB
Size

23
Cookies

48 Outgoing links

These are links going to different origins than the main page.

URL: https://threatlabz.zscaler.com/
Title: ThreatLabz

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/phone-support
Title: Support

Search URL Search Domain Scan URL

URL: https://admin.zscaler.net/
Title: Zscaler Cloud Portal | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerone.net/
Title: Zscaler Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalertwo.net/
Title: Zscaler Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerthree.net/
Title: Zscaler Cloud Portal Three | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerbeta.net/
Title: Zscaler Cloud Portal Beta | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscloud.net/
Title: admin.zscloud.net

Search URL Search Domain Scan URL

URL: https://admin.private.zscaler.com/
Title: Zscaler Private Access Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zpatwo.net/
Title: Zscaler Private Access Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://partners.zscaler.com/s/partneronboarding
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://threatlabz.zscaler.com/cloud-insights/cloud-activity-dashboard
Title: ThreatLabz Analytics

Search URL Search Domain Scan URL

URL: http://securitypreview.zscaler.com/
Title: Security Preview

Search URL Search Domain Scan URL

URL: https://testmydefenses.com/ransomware-assessment
Title: Security and Risk Assessment

Search URL Search Domain Scan URL

URL: https://customer.zscaler.com/
Title: Customer Success Center

Search URL Search Domain Scan URL

URL: https://community.zscaler.com/
Title: Zenith Community

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/
Title: Zscaler Help Portal

Search URL Search Domain Scan URL

URL: https://ir.zscaler.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://tinyurl.com/yptvayc9

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https://tinyurl.com/yptvayc9%20%E2%80%94%20Technical%20Analysis%20of%20DarkVision%20RAT%22

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://tinyurl.com/yptvayc9

Search URL Search Domain Scan URL

URL: https://github.com/TheWover/donut
Title: Donut loader

Search URL Search Domain Scan URL

URL: https://thewover.github.io/Introducing-Donut/
Title: write-ups

Search URL Search Domain Scan URL

URL: https://github.com/volexity/donut-decryptor
Title: Donut Decryptor

Search URL Search Domain Scan URL

URL: https://threatlibrary.zscaler.com/threats/40289b48-73f7-4942-8da7-62e0e70879fa
Title: Win32.RAT.DarkVision

Search URL Search Domain Scan URL

URL: https://threatlibrary.zscaler.com/threats/b13c8b1e-763a-4cf4-a8f0-20f9dec3dd63?_gl=1*gw8w0l*_gcl_au*ODM3NTA3MTQ1LjE3MjM0Njg5Nzg.*_ga*NDIxMzgzNDc3LjE3MDc3MTkyNzM.*_ga_10SPJ4YJL9*MTcyNzQxMzQwMS4yMTMuMS4xNzI3NDEzNDU1LjYuMC4xMzQ3OTQ2NjE1
Title: Win32.Downloader.PureCrypter

Search URL Search Domain Scan URL

URL: https://threatlibrary.zscaler.com/threats/42a17a61-d351-4084-ba72-e534b492aec7
Title: Win32.Trojan.Donut

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1053/005/
Title: T1053.005

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1547/001/
Title: T1547.001

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1055
Title: T1055

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1140/
Title: T1140

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1562/001/
Title: T1562.001

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1539/
Title: T1539

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1010
Title: T1010

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1057
Title: T1057

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1082
Title: T1082

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1083
Title: T1083

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1123/
Title: T1123

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1125/
Title: T1125

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1113/
Title: T1113

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1056/001/
Title: T1056.001

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1219/
Title: T1219

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1571/
Title: T1571

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1529/
Title: T1529

Search URL Search Domain Scan URL

URL: https://www.facebook.com/zscaler
Title: Visit us on Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zscaler
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.twitter.com/zscaler
Title: Follow us on Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/ZscalerMarketing
Title: Subscribe our Youtube Channel

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 73

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=354250153&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI4PnBhOqRiQMVk1lHAR17iyjKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8 HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=354250153&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI4PnBhOqRiQMVk1lHAR17iyjKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwDpaXnfNnAx7Wa1XVuxVqOPXvJVL6teZYBfNg&random=2929047499

Request Chain 108

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1371874676&cv=11&fst=1729044858331&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&gtm_ee=1&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIjsvUhOqRiQMV3GJHAR0MNAdAMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUk4S1c0dUFZUXctbU4tdktEbUwzWkFSSXNBT2MzQTRDdF9qWXRpTHlpaFYtdk1lNnBWUWZaVzFveTNZY3lZWHctdEpzMzdYSTMzdk5nWmNQQTdhaw HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?random=1371874676&cv=11&fst=1729044858331&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&gtm_ee=1&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIjsvUhOqRiQMV3GJHAR0MNAdAMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUk4S1c0dUFZUXctbU4tdktEbUwzWkFSSXNBT2MzQTRDdF9qWXRpTHlpaFYtdk1lNnBWUWZaVzFveTNZY3lZWHctdEpzMzdYSTMzdk5nWmNQQTdhaw&is_vtc=1&cid=CAQSKQDpaXnf8z1BZWIEwd6N5mVtKa0C0A5Z409UNTUIXMAb4KBq-ticM5Ik&random=4098851899

139 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request technical-analysis-darkvision-rat Show response
www.zscaler.com/blogs/security-research/ 429 KB
73 KB 173ms
91ms Document
text/html 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

8b1a0e0abb57b4f1c00a4a5197e0229c1ec9db6a0d8c12866f3cc47036937098

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscaler.my.site.com/ https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age: 8663
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit; fwd=stale
cf-cache-status: DYNAMIC
cf-ray: 8d3488d2fa1843dc-EWR
content-encoding: br
content-security-policy: default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://*.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com *.mountain.com https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://*.pathfactory.com https://explore.zscaler.com; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://*.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://*.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://*.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscaler.my.site.com/ https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://*.adroll.com/ https://explore.zscaler.com; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com;
content-type: text/html; charset=utf-8
date: Wed, 16 Oct 2024 02:14:16 GMT
netlify-vary: header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data
server: cloudflare
strict-transport-security: max-age=31536000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN https://cms.zscaler.com
x-nextjs-date: Tue, 15 Oct 2024 23:52:48 GMT
x-nf-request-id: 01JA9HNG0QC2QC455GY0H0JYQ3
x-powered-by: Next.js
x-xss-protection: 1; mode=block

GET
H2 200 1395e54b70b06b444656a2f40c135374.js Show response
ob.iseaskies.com/i/ 108 KB
40 KB 126ms
14ms Script
text/javascript 2600:9000:250a:7c00:c:d449:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:c:d449:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Caddy /
Resource Hash: fa5c21a013b645f008573c41ffaea2cb09df3ec637e75c0d23902e3703d989dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: "1af74-8/Ri3G7sU5wzfi4qukfwRHTHL3k"
age: 26610
via: 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
expires: Wed, 16 Oct 2024 06:50:47 GMT
x-cache: Hit from cloudfront
content-length: 40386
x-amz-cf-id: u3XH7MNtVii0VAm5hXcHl2Tlsmr2k08Iir7dzx2tIkeRfVqix8V5Qg==
date: Tue, 15 Oct 2024 18:50:47 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: Caddy
x-amz-cf-pop: IAD12-P3

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/ 356 KB
41 KB 61ms
33ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/OtAutoBlock.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eddd884436be08bc6ecaff1ea001f0f68eea7fe12664000a6f3646e07961a061

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: wwQGGjy2I9fD9PfR8JuF1w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE50A464C63D1
age: 67812
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 17 Oct 2024 02:14:16 GMT
date: Wed, 16 Oct 2024 02:14:16 GMT
content-type: application/javascript
last-modified: Sat, 05 Oct 2024 06:52:27 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: e773a91a-201e-001b-6ef3-16bd18000000
cf-ray: 8d3488d3cd9443c1-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41741
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 28ms
20ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCECBD439DB9BF
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 59538
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:16 GMT
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 02:01:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8f7ade6b-901e-0064-2ea7-1e232a000000
cf-ray: 8d3488d3dda443c1-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET image
www.zscaler.com/_next/ 0
0

GET
H2 200 219e54771de95554-s.p.woff2
www.zscaler.com/_next/static/media/ 37 KB
37 KB 58ms
52ms Font
font/woff2 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/219e54771de95554-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "ee94ab2a11412903ad9756e2edb68d05-ssl"
age: 4532
x-content-type-options: nosniff
cf-ray: 8d3488d3aae643dc-EWR
accept-ranges: bytes
content-length: 37876
x-nf-request-id: 01JA9HNG3H3RY7YTCAV2VQ4X5F
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 86085b213eb89904-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
39 KB 55ms
50ms Font
font/woff2 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/86085b213eb89904-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "9430f4d344e4fa79ef6a839ba362694c-ssl"
age: 4892
x-content-type-options: nosniff
cf-ray: 8d3488d3aae743dc-EWR
accept-ranges: bytes
content-length: 40264
x-nf-request-id: 01JA9HNG3CSVT9AZ0WFJ27ZRW4
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 9cdafb0650413334-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
40 KB 62ms
57ms Font
font/woff2 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/9cdafb0650413334-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "aa81c4751d270062c6783d25c81b8021-ssl"
age: 19439
x-content-type-options: nosniff
cf-ray: 8d3488d3aae843dc-EWR
accept-ranges: bytes
content-length: 40336
x-nf-request-id: 01JA9HNG3KG58MH0YBWN1NH27H
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 4012cc4b67ad157d-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 57ms
53ms Font
font/woff2 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/4012cc4b67ad157d-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "93ae142d2bfd17c936f3d91401658758-ssl"
age: 17355
x-content-type-options: nosniff
cf-ray: 8d3488d3aaea43dc-EWR
accept-ranges: bytes
content-length: 9592
x-nf-request-id: 01JA9HNG3EQNQVHDZG52XN8YW5
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 41998fdc1b8220a0-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
10 KB 63ms
59ms Font
font/woff2 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/41998fdc1b8220a0-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "672d4a5030823e96757755c555bf2027-ssl"
age: 6583
x-content-type-options: nosniff
cf-ray: 8d3488d3aaeb43dc-EWR
accept-ranges: bytes
content-length: 9620
x-nf-request-id: 01JA9HNG3HE3MYF3J8A43YY7GG
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 edb9f1eb1c1a7ead-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 62ms
58ms Font
font/woff2 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/edb9f1eb1c1a7ead-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "e32ff74f0d5d916b5dda832b01fd5fc8-ssl"
age: 23806
x-content-type-options: nosniff
cf-ray: 8d3488d3aaec43dc-EWR
accept-ranges: bytes
content-length: 8780
x-nf-request-id: 01JA9HNG3HSV2TT5RZMT99ECQB
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 ce9b84dce7581e2b-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 70ms
66ms Font
font/woff2 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/ce9b84dce7581e2b-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "067a5289e0e684ba833d5d7b2beb3f51-ssl"
age: 22572
x-content-type-options: nosniff
cf-ray: 8d3488d3baf443dc-EWR
accept-ranges: bytes
content-length: 8764
x-nf-request-id: 01JA9HNG3PP4DAQC43K3EK46FB
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 0f03fd2e7390fc5a.css
www.zscaler.com/_next/static/css/ 118 KB
23 KB 57ms
53ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/0f03fd2e7390fc5a.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21c35ca7dcb88e44359a2bc40e304a728c6d0db54fbf690a3459fb331cd19395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9f88f3226298c33b8ecffcb313ad583e-ssl-df"
age: 17274
x-content-type-options: nosniff
cf-ray: 8d3488d3aadf43dc-EWR
x-nf-request-id: 01JA9HNG3GEAA9209QRQC3TRBP
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1cfd645b5dee043a.css
www.zscaler.com/_next/static/css/ 93 KB
12 KB 49ms
46ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/1cfd645b5dee043a.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c683d7f82f98fd9ac028f600f7cc1693c8ff20cba9f0176d8a3574e8eae2dd69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"289c3a1956bbff98f5bcd0650da3cea1-ssl-df"
age: 23713
x-content-type-options: nosniff
cf-ray: 8d3488d3aae143dc-EWR
x-nf-request-id: 01JA9HNG2QE02JDWSPJA975WYC
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 60ab7ffa9f7999ec.css
www.zscaler.com/_next/static/css/ 849 B
390 B 58ms
55ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/60ab7ffa9f7999ec.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4fd28ce5d07640308fd628361ee9dd2e-ssl"
age: 16752
x-content-type-options: nosniff
cf-ray: 8d3488d3aae443dc-EWR
x-nf-request-id: 01JA9HNG3J0DJ390C9QEXT32J8
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
server: cloudflare

GET
H2 200 54b114f76a2643a4.css
www.zscaler.com/_next/static/css/ 14 KB
2 KB 60ms
57ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/54b114f76a2643a4.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9b8c484af22ed99c9052a8a53f1fb90c-ssl-df"
age: 14634
x-content-type-options: nosniff
cf-ray: 8d3488d3aae543dc-EWR
x-nf-request-id: 01JA9HNG3K3H75E3BR6HQGQJE1
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 daafa75b3cb42d40.css
www.zscaler.com/_next/static/css/ 16 KB
2 KB 77ms
75ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/daafa75b3cb42d40.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc2754d0558c2e23d1fc81a1e76a0b1febe1afe5eecdc5fadc75f9c33a44f1ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"cec9f066c000b60c944c45c241191362-ssl-df"
age: 18591
x-content-type-options: nosniff
cf-ray: 8d3488d3baf643dc-EWR
x-nf-request-id: 01JA9HNG3RN4RSRDF34P513W6G
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 455227249223c84c.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 63ms
60ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/455227249223c84c.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"c7271019cbe209844cca8826be137418-ssl-df"
age: 16367
x-content-type-options: nosniff
cf-ray: 8d3488d3baf943dc-EWR
x-nf-request-id: 01JA9HNG3NDNDR3H1SPE65X93B
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 59cb0a1d87010ab3.css
www.zscaler.com/_next/static/css/ 19 KB
3 KB 62ms
60ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/59cb0a1d87010ab3.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c57780c294c4ac3bb4790f10f11ab4afe4e323819d2ae1278de9cc6b390fc7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9036d3452601bc5060c3cd0511dd853c-ssl-df"
age: 16752
x-content-type-options: nosniff
cf-ray: 8d3488d3bafa43dc-EWR
x-nf-request-id: 01JA9HNG3MPCXK2GWM0PPCH5SV
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 d34fc117d4462dbb.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 61ms
59ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/d34fc117d4462dbb.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a2957e3f52eaaa2164c4c260e8a99bde-ssl-df"
age: 18226
x-content-type-options: nosniff
cf-ray: 8d3488d3baff43dc-EWR
x-nf-request-id: 01JA9HNG3M5XF1MCCSTHZQR4HK
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 c688bfb319a77543.css
www.zscaler.com/_next/static/css/ 96 KB
13 KB 68ms
67ms Stylesheet
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/c688bfb319a77543.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d8db1e6933ea20fefa725b8f886ee547bf40b730b6f2ab25e917640aaf9f37b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"b8ac6b347d5bacbe00c4e2ea1c0eb70f-ssl-df"
age: 23277
x-content-type-options: nosniff
cf-ray: 8d3488d3bb0143dc-EWR
x-nf-request-id: 01JA9HNG3TXJ0QQDMZZ117N1E9
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 7566.1aab9269b62f298f.js Show response
www.zscaler.com/_next/static/chunks/ 10 KB
4 KB 62ms
55ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7566.1aab9269b62f298f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53383e308071f119680221c3529389b52db8b9fd233bac6f244c5912c2950598

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"ebac2132655b225bc4dd4a83ed087f65-ssl-df"
age: 14634
x-content-type-options: nosniff
cf-ray: 8d3488d3db2e43dc-EWR
x-nf-request-id: 01JA9HNG4HX5B7DZNFJDJCHG09
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6804.777ea7ad2bf59dcd.js Show response
www.zscaler.com/_next/static/chunks/ 8 KB
3 KB 44ms
37ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6804.777ea7ad2bf59dcd.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd8134b4043cb1ce2a1641c56a93561d99bb541ff9820b3c0e115e1b70dd9be3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"c31c4e287a21317606022d71dc9b58eb-ssl-df"
age: 17638
x-content-type-options: nosniff
cf-ray: 8d3488d3db2f43dc-EWR
x-nf-request-id: 01JA9HNG3YQQ1QERD758CZN3YJ
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 537.8ad21235b8edef2f.js Show response
www.zscaler.com/_next/static/chunks/ 604 B
435 B 63ms
56ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/537.8ad21235b8edef2f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67bada63c3654c7168cedb6be0924d793dc683e81ae6740e3e14f3b181b94ff3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"eb0384336b3b3bd6ecd5fe6de7da10a3-ssl"
age: 17885
x-content-type-options: nosniff
cf-ray: 8d3488d3db3043dc-EWR
x-nf-request-id: 01JA9HNG4GECAT8NB4YEB9J895
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 8338.7bc0a0f66b4180fe.js Show response
www.zscaler.com/_next/static/chunks/ 115 KB
37 KB 38ms
32ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/8338.7bc0a0f66b4180fe.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e9c619da677845336e5715fd09f8feb00d9ea39c0797c123477725107e3f776

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9fae3ba2c2f7d5767d49a6dae2daa2b1-ssl-df"
age: 5326
x-content-type-options: nosniff
cf-ray: 8d3488d3db3143dc-EWR
x-nf-request-id: 01JA9HNG3KFADQP6JZY99SME6P
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 287.bdc982e1e7747150.js Show response
www.zscaler.com/_next/static/chunks/ 4 KB
2 KB 63ms
57ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/287.bdc982e1e7747150.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8b9a51270687afddae089d22440c5231d2876679c608fafe460d4caa2d12c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"e2bb6924e90a61b7aeacdd8aa7f51e92-ssl-df"
age: 17817
x-content-type-options: nosniff
cf-ray: 8d3488d3db3343dc-EWR
x-nf-request-id: 01JA9HNG4GR0WNBWXS1N63J1JP
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 9775.864cadc11d0a4959.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 63ms
57ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9775.864cadc11d0a4959.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b677e677ced8c4a836aed76512f225e795edc1b19123c4cf94a765f8fe89d192

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"f4974b41a1ca9de478aa67bb323de449-ssl-df"
age: 17638
x-content-type-options: nosniff
cf-ray: 8d3488d3db3543dc-EWR
x-nf-request-id: 01JA9HNG4H58YVH05Y57EJKF5D
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1306.3de21e0b58c1dbf6.js Show response
www.zscaler.com/_next/static/chunks/ 7 KB
3 KB 44ms
38ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1306.3de21e0b58c1dbf6.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36abed3d20085dbc2ef2778631d3f5efd0e8000db1925e2de3a18649671d4e02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4341edcd3cc895da095a035c6f37094f-ssl-df"
age: 16714
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3643dc-EWR
x-nf-request-id: 01JA9HNG3XFGWNW67FGNHH4P6G
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2284.c5d0a6b845f2ee47.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 73ms
67ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2284.c5d0a6b845f2ee47.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b026ac8e9b650f8a85c8a082f913b04eaa7dde4bf82bef0512f352891b3e0758

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"2caf290570b3ed54cb6e58790db6b04c-ssl-df"
age: 15360
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3843dc-EWR
x-nf-request-id: 01JA9HNG4HBGF8BAE0DF8XDJKT
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 893.54805bf89f589fdc.js Show response
www.zscaler.com/_next/static/chunks/ 42 KB
14 KB 46ms
41ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/893.54805bf89f589fdc.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76c645171496c5a2725d98c02c1628dc97fad5696e805bd1714846488c2ec7a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"e165934725b6b0fdf9d2a609bbd40dfd-ssl-df"
age: 17833
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3943dc-EWR
x-nf-request-id: 01JA9HNG3ZGDEK9705NS5EPE2C
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 webpack-043599f8d549a759.js Show response
www.zscaler.com/_next/static/chunks/ 11 KB
6 KB 72ms
66ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/webpack-043599f8d549a759.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b15f5190f031b915809b1896373f463a17135a16282e6b28f24d5a485d919fce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a6fa0da0964c8a7f0764349bd3b7584c-ssl-df"
age: 18873
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3a43dc-EWR
x-nf-request-id: 01JA9HNG4HDAB6PQGSMVGGYRJG
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 framework-0e8d27528ba61906.js Show response
www.zscaler.com/_next/static/chunks/ 138 KB
45 KB 48ms
44ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/framework-0e8d27528ba61906.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd06da99f01b4d5e3fc4c54e4e3cf4ae18803c08bc113e4cb923638d6e683278

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"15c5453fde673f8d2d1a785c3079ec8f-ssl-df"
age: 7850
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3b43dc-EWR
x-nf-request-id: 01JA9HNG3ZPX7HRPCFG1N4W0EW
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main-bf56e129e9a973c7.js Show response
www.zscaler.com/_next/static/chunks/ 110 KB
33 KB 43ms
38ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/main-bf56e129e9a973c7.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

774e08566a15a9afbb217705a2ca66fa20dc5b34885b6977d428220993147106

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"2f0931eeb810ed6316e8583b33333205-ssl-df"
age: 17372
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3c43dc-EWR
x-nf-request-id: 01JA9HNG3YQMMGCTS1RAA6SQ1P
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _app-6e7797028c0c969c.js Show response
www.zscaler.com/_next/static/chunks/pages/ 421 KB
136 KB 51ms
47ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/_app-6e7797028c0c969c.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98fc9c4af2180c95232f81c395a3cee05515c0c16c01f03ce5516200b5c05644

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"cd051ace3506f4802b9abef4cc77940d-ssl-df"
age: 21545
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3d43dc-EWR
x-nf-request-id: 01JA9HNG3Y5ZGQNJPAVJ5H0QPP
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2635-4e54b23c0b24202a.js Show response
www.zscaler.com/_next/static/chunks/ 208 KB
56 KB 68ms
64ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2635-4e54b23c0b24202a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6dbe68c57ab192827f81a77e6eb981ca8148a82d352a8c47073204feff64bbfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"37ddb2f22cf5fc2f0d4334c1f57c820d-ssl-df"
age: 2968
x-content-type-options: nosniff
cf-ray: 8d3488d3eb3e43dc-EWR
x-nf-request-id: 01JA9HNG4HBRF5BJ05ZCJ3XRG9
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5865-09ac5a68cb70c7f3.js Show response
www.zscaler.com/_next/static/chunks/ 135 KB
38 KB 43ms
39ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/5865-09ac5a68cb70c7f3.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42c3dfb68ff11fe295d20cdd98826c65161cf5d480d25f72b10d9a182f9e2a1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"29d1cb8e65d6157cd30fa2bb784eb560-ssl-df"
age: 17817
x-content-type-options: nosniff
cf-ray: 8d3488d3eb4043dc-EWR
x-nf-request-id: 01JA9HNG3ZVSW7PQAC3ACHB68V
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6882-cdc46c2a06128381.js Show response
www.zscaler.com/_next/static/chunks/ 60 KB
18 KB 50ms
46ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6882-cdc46c2a06128381.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

32002930f50b9bea45f84d40a2a4174520a6ffcbae0df734c015962639c377b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"dd40b96b05ad28001e8d5e7385ed82ed-ssl-df"
age: 24802
x-content-type-options: nosniff
cf-ray: 8d3488d3eb4343dc-EWR
x-nf-request-id: 01JA9HNG43CNXCTP6K368Y6A1M
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6939-a78b5d9e9aa76f19.js Show response
www.zscaler.com/_next/static/chunks/ 138 KB
31 KB 67ms
63ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6939-a78b5d9e9aa76f19.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b6b7b5eae5f0a754d35e48e9e610ba5f0924944dd4461cac77d05f4c5a9368d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"70894520561f2227e78f8430e145f62b-ssl-df"
age: 3373
x-content-type-options: nosniff
cf-ray: 8d3488d3eb4543dc-EWR
x-nf-request-id: 01JA9HNG4NZ9S5GNWSS2A8KH07
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 %5B...slug%5D-9f97f250bc4e121e.js Show response
www.zscaler.com/_next/static/chunks/pages/blogs/ 3 KB
1 KB 63ms
59ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/blogs/%5B...slug%5D-9f97f250bc4e121e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9582e9526f2849403cbbc760837b703608149a8f003ab2cef5bbb12693b18332

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a46ad8e64c7cc9278e7adafea72bf6a4-ssl-df"
age: 14634
x-content-type-options: nosniff
cf-ray: 8d3488d3eb4643dc-EWR
x-nf-request-id: 01JA9HNG4KTAY0G766Q1NCYQJK
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _buildManifest.js Show response
www.zscaler.com/_next/static/gr1uhlHFgLOpXqxaj7F8G/ 3 KB
1 KB 70ms
67ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/gr1uhlHFgLOpXqxaj7F8G/_buildManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

093a32c78bbd0d8bfa29c3c98a6343ae00ce1fd759bdf71c8429876633fba23b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"5779803e70607cd73b5840bd0c0200d0-ssl-df"
age: 16907
x-content-type-options: nosniff
cf-ray: 8d3488d3eb4943dc-EWR
x-nf-request-id: 01JA9HNG4H1MHJMDAY8VY7HGBV
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _ssgManifest.js Show response
www.zscaler.com/_next/static/gr1uhlHFgLOpXqxaj7F8G/ 449 B
296 B 66ms
63ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/gr1uhlHFgLOpXqxaj7F8G/_ssgManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"d483bd250a3ef832dcda9d330b187d08-ssl"
age: 16892
x-content-type-options: nosniff
cf-ray: 8d3488d3eb4b43dc-EWR
x-nf-request-id: 01JA9HNG4K7MMSZ5W6W1FRY1FP
date: Wed, 16 Oct 2024 02:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 email-decode.min.js Show response
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
818 B 15ms
14ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"67055fd4-4d7"
x-content-type-options: nosniff
cf-ray: 8d3488d3eb4c43dc-EWR
expires: Fri, 18 Oct 2024 02:14:16 GMT
date: Wed, 16 Oct 2024 02:14:16 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2024 16:37:40 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: DENY

GET
H2 200 3e894970-e3e9-4783-85e9-7c38eedbfbbf.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/ 6 KB
2 KB 56ms
36ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/3e894970-e3e9-4783-85e9-7c38eedbfbbf.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ab49fd90ca814517ecccd0199152e764e8fcb16e0fd6ed91358d3aea88f753f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: HpD+28GsI57ANX5weGb5dA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE50A42B7B0F7
age: 62241
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 17 Oct 2024 02:14:17 GMT
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/json
last-modified: Sat, 05 Oct 2024 06:52:21 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 4506cec4-a01e-000a-41f3-168a03000000
cf-ray: 8d3488d4799b43bb-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1854
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 5 KB
5 KB 37ms
36ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FGartner-report.png&w=256&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f0ce935f23a1a787a427daf4fd07dd3a394d6ad5b0f4dc74238c76125061f80

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: DYNAMIC
age: 17662
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Tue, 15 Oct 2024 21:19:55 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8d3488d50cc343dc-EWR
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4948
x-nf-request-id: 01JA9HNG9HQGBXS058AJM22RXZ
cache-status: "Netlify Edge"; hit
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 10 KB
10 KB 34ms
33ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FCxo-revolutionaries.png&w=384&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

945881686d0a47eee9946902d92626dbfab4570d3c5fab2cb7c6e3343ee01f5c

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: DYNAMIC
age: 18936
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Tue, 15 Oct 2024 20:58:42 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8d3488d50cc443dc-EWR
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10336
x-nf-request-id: 01JA9HNG9F9XMFVATFE7VMSES6
cache-status: "Netlify Edge"; hit
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 4 KB
4 KB 53ms
52ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=%2Fassets%2Fimages%2Fdefault-avatar.png&w=96&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09ffe1ebce8835c9b4d8232b59214200e95e6c2d2a3d67aba4d3f578051cd3a8

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: DYNAMIC
age: 51306
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Tue, 15 Oct 2024 11:59:10 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy
cache-control: public,max-age=0,must-revalidate
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8d3488d50cc543dc-EWR
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3824
x-nf-request-id: 01JA9HNG9NXAZPDRMZ610S88V1
cache-status: "Netlify Edge"; fwd=stale
server: cloudflare

GET
H2 200 DarkVision%20RAT%20(1).png
www.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/ 16 KB
17 KB 268ms
267ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/DarkVision%20RAT%20(1).png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81526ba2b84901c932e590cf5a995bb42aa4adfcadb51abc11fd1dcd6437c838

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: REVALIDATED
etag: "cfVdQ26irPglUl1RbQqdlyn4cY1gWqs-rDoNB_ezzVDw"
cf-bgj: imgq:85,h2pri
cf-resized: internal=ok/d q=0 n=211+149 c=0+0 v=2024.10.0 l=16531 f=false
warning: cf-images 299 "cache-control is too restrictive"
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Wed, 09 Oct 2024 18:52:12 GMT
vary: Accept, Accept-Encoding
strict-transport-security: max-age=31536000; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=300
cf-ray: 8d3488d50cc843dc-EWR
accept-ranges: bytes
content-length: 16531
server: cloudflare

GET
H2 200 7763.d758ee891eda7402.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
736 B 30ms
28ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7763.d758ee891eda7402.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-043599f8d549a759.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"0500e040eba5ed9e5d82333085bd8bd7-ssl-df"
age: 17721
x-content-type-options: nosniff
cf-ray: 8d3488d55d4543dc-EWR
x-nf-request-id: 01JA9HNGB4JMDNNTEZPF346YWT
date: Wed, 16 Oct 2024 02:14:17 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5551.c4fb596d5a66633e.js Show response
www.zscaler.com/_next/static/chunks/ 1000 B
761 B 28ms
27ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/5551.c4fb596d5a66633e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-043599f8d549a759.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"b43ee5b23a7cf90ba2dca725f4930f2a-ssl"
age: 16956
x-content-type-options: nosniff
cf-ray: 8d3488d55d4743dc-EWR
x-nf-request-id: 01JA9HNGB2507PF9SBX0T7GM4F
date: Wed, 16 Oct 2024 02:14:17 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 6023.ccb3fff03c4fa91a.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
730 B 32ms
31ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6023.ccb3fff03c4fa91a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-043599f8d549a759.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"39ccbb757c413d78d0f9a1a8014d51bb-ssl-df"
age: 16849
x-content-type-options: nosniff
cf-ray: 8d3488d55d4943dc-EWR
x-nf-request-id: 01JA9HNGB3EX79NN15W02G5QPR
date: Wed, 16 Oct 2024 02:14:17 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 790.d7dc94c2ef6f512f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
841 B 29ms
29ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/790.d7dc94c2ef6f512f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-043599f8d549a759.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"6ff1ada259784a3388a9c23908ebebdc-ssl-df"
age: 17276
x-content-type-options: nosniff
cf-ray: 8d3488d55d4a43dc-EWR
x-nf-request-id: 01JA9HNGB6A0JXDCBZB9RVQ6BJ
date: Wed, 16 Oct 2024 02:14:17 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6831.3072668993ea221f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
726 B 32ms
32ms Script
application/javascript 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6831.3072668993ea221f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-043599f8d549a759.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7c416a32791e45716f8ef3dec7caa745-ssl-df"
age: 18394
x-content-type-options: nosniff
cf-ray: 8d3488d55d4c43dc-EWR
x-nf-request-id: 01JA9HNGB51Z8FFASHHB7NM702
date: Wed, 16 Oct 2024 02:14:17 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 69 B
305 B 56ms
34ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59e58524340cd7ad353be010374b124c242fdde10a0ed41047fe2fd4bb9e5a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8d3488d5bc938ce9-EWR
access-control-allow-origin: *
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 image
www.zscaler.com/_next/ 25 KB
25 KB 33ms
32ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2F----category-images%2Fcyber-security%2Fzscaler-blog-cyber-security-2%25402x.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/5865-09ac5a68cb70c7f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64062b0a850bf476137d3d871000817e2d8f8e8a5461f1918a357348310535b3

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: DYNAMIC
age: 29605
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Tue, 15 Oct 2024 18:00:52 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8d3488d64e7f43dc-EWR
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25541
x-nf-request-id: 01JA9HNGFRFYWV44F2GVSEMTKS
cache-status: "Netlify Edge"; hit
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 22 KB
22 KB 31ms
30ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fblog-GettyImages-1281179480_0.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/5865-09ac5a68cb70c7f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efc5d1f211335a1a7de421ce74c9826b8c93235647ccc6a142715c1a90182108

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: DYNAMIC
age: 3173
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Wed, 16 Oct 2024 01:21:24 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8d3488d64e8143dc-EWR
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22080
x-nf-request-id: 01JA9HNGFSYGSWR9B86J1JNWVQ
cache-status: "Netlify Edge"; hit
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 49 KB
49 KB 31ms
31ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/5865-09ac5a68cb70c7f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

866d87e06710596a49ecb75a43f613e79874ac106da45115b1586dd5e071a52d

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: DYNAMIC
age: 4393
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Wed, 16 Oct 2024 01:01:03 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8d3488d64e8243dc-EWR
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 49799
x-nf-request-id: 01JA9HNGFWZE2XF56NVTWXKYSK
cache-status: "Netlify Edge"; hit
server: cloudflare

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ 199 KB
67 KB 223ms
36ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-bf56e129e9a973c7.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "301128-31b91-62370c030d900"
age: 3186
x-content-type-options: nosniff
cf-ray: 8d3488d77a564297-EWR
expires: Wed, 16 Oct 2024 06:14:17 GMT
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/x-javascript
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 401 KB
127 KB 94ms
43ms Script
application/javascript 2607:f8b0:400d:c03::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-bf56e129e9a973c7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c03::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

828fed5bd0375a9f0485a2a756b841c572860e90eb25ef716e49dbc8ec61e691

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Wed, 16 Oct 2024 02:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 16 Oct 2024 00:43:33 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 129091
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 1cfd645b5dee043a.css Show response
www.zscaler.com/_next/static/css/ 93 KB
117 B 34ms
32ms Fetch
text/css 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/1cfd645b5dee043a.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-bf56e129e9a973c7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c683d7f82f98fd9ac028f600f7cc1693c8ff20cba9f0176d8a3574e8eae2dd69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"289c3a1956bbff98f5bcd0650da3cea1-ssl-df"
age: 23713
x-content-type-options: nosniff
cf-ray: 8d3488d67eb643dc-EWR
x-nf-request-id: 01JA9HNGGQAF6YPD6DS28EAFZ4
date: Wed, 16 Oct 2024 02:14:17 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/ 457 KB
111 KB 25ms
24ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: Mq8sWt7aN99kE/VZ97+T8Q==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCECBD4252FE38
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 59402
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 02:01:18 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 9bab6f91-c01e-00f4-4acd-1eb666000000
cf-ray: 8d3488d6c8d943c1-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 113760
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 260 KB
260 KB 52ms
52ms Image
image/avif 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fhazard_darkvision_rat.jpeg&w=1920&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b63fbaaedff3fcec4813eb099464737abb62aac29d9f176b3421e3897a9b78b7

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

cf-cache-status: DYNAMIC
age: 866
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: image/avif
last-modified: Wed, 16 Oct 2024 01:59:51 GMT
vary: Accept
strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cf-ray: 8d3488d71f7743dc-EWR
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
accept-ranges: bytes
access-control-allow-origin: *
content-length: 266003
x-nf-request-id: 01JA9HNGKXG4J67P199PA7KBMH
cache-status: "Netlify Edge"; fwd=miss
server: cloudflare

GET
H2 200 117186981.js Show response
cdn.intellimize.co/snippet/ 494 KB
108 KB 72ms
9ms Script
application/javascript 151.101.2.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.intellimize.co/snippet/117186981.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-bf56e129e9a973c7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

25134b07108d90e56e3cb611cf2629d447a87dcc7bbd2ba6ff6c4d0de9a1b484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=0, must-revalidate
content-encoding: gzip
etag: "033d36d3304a1f1d8577adfa1f1b761db--gzip"
age: 250
x-timer: S1729044858.577208,VS0,VE1
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 110555
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript;charset=utf-8
x-served-by: cache-lga21926-LGA
x-cache-hits: 0
vary: Intellimize-Namespace, Intellimize-StatusModule, Accept-Encoding

GET
H2 200 ct Show response
obs.iseaskies.com/ 4 KB
2 KB 124ms
65ms Script
text/javascript 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/ct?id=60409&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1729044857614&hl=2&op=0&ag=566412661&rand=9359876210612989169275005110981654755547782988137767980195262402109222201922561287520&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDE0NjhdLFsiYWJuY2giLDI4XSxbLTQsIjxodG1sIGxhbmc9XCJlblwiPjxoZWFkPjxtZXRhIGNoYXJzZXQ9XCJ1dGYtOFwiPjxtZXRhIG5hbWU9XCJ2aWV3cG9ydFwiIGNvbnRlbnQ9XCJ3aWR0aD1kZXZpY2Utd2lkdGhcIj48c2NyaXB0IGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9vYi5pc2Vhc2tpZXMuY29tL2kvMTM5NWU1NGI3MGIwNmI0NDQ2NTZhMmY0MGMxMzUzNzQuanNcIiBkYXRhLWNoPVwiY2hlcTRwcGNcIiBjbGFzcz1cImpzeC0xNTMxNjM5MzM1IGN0X2NsaWNrdHJ1ZV82MDQwOVwiPjwvc2NyaXB0PjxsaW5rIHJlbD1cInByZWNvbm5lY3RcIiBocmVmPVwiLy9pbmZvLnpzY2FsZXIuY29tXCIgY2xhc3M9XCJqc3gtMTUzMTYzOTMzNVwiPjxzY3JpcHQgaWQ9XCJjb29raWVsYXctT3RBdXRvQmxvY2stc2NyaXB0XCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIHNyYz1cImh0dHBzOi8vY2RuLmNvb2tpZWxhdy5vcmcvY29uc2VudC8zZTg5NDk3MC1lM2U5LTQ3ODMtODVlOS03YzM4ZWVkYmZiYmYvT3RBdXRvQmxvY2suanNcIiBkZWZlcj1cIlwiIGNsYXNzPVwianN4LTE1MzE2MzkzMzVcIj48L3NjcmlwdD48c2NyaXB0IGlkPVwiY29va2llbGF3LW90U0RLU3R1Yi1zY3JpcHRcIiBzcmM9XCJodHRwczovL2Nkbi5jb29raWVsYXcub3JnL3NjcmlwdHRlbXBsYXRlcy9vdFNES1N0dWIuanNcIiBkYXRhLWxhbmd1YWdlPVwiZW5cIiBkYXRhLWRvY3VtZW50LWxhbmd1YWdlPVwidHJ1ZVwiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBkYXRhLWRvbWFpbi1zY3JpcHQ9XCIzZTg5NDk3MC1lM2U5LTQ3ODMtODVlOS03YzM4ZWVkYmZiYmZcIiBkZWZlcj1cIlwiIGNsYXNzPVwianN4LTE1MzE2MzkzMzVcIj48L3NjcmlwdD48c2NyaXB0IGlkPVwiY29va2llbGF3LU9wdGFub25XcmFwcGVyLXNjcmlwdFwiIGNsYXNzPVwianN4LTE1MzE2MzkzMzVcIj5cbiAgICAgICAgICAgICAgICBmdW5jdGlvbiBPcHRhbm9uV3JhcHBlcigpIHsgfVxuICAgICAgICAgICAgICA8L3NjcmlwdD48dGl0bGU%2BRGFya1Zpc2lvbiBSQVQgfCBUaHJlYXRMYWJ6PC90aXRsZT48bWV0YSBuYW1lPVwiZGVzY3JpcHRpb25cIiBjb250ZW50PVwiVW5jb3ZlciB0aGUgbGF0ZXN0IGNhbXBhaWduIHVzaW5nIERhcmtWaXNpb24gUkFUIGFuZCBQdXJlQ3J5cHRlci4gTGVhcm4gYWJvdXQgYXR0YWNrIHRlY2huaXF1ZXMsIHBlcnNpc3RlbmNlLCBhbmQgY29tbWFuZC1saW5lIHBhcnNpbmcuXCI%2BPGxpbmsgcmVsPVwiY2Fub25pY2FsXCIgaHJlZj1cImh0dHBzOi8vd3d3LnpzY2FsZXIuY29tL2Jsb2dzL3NlY3VyaXR5LXJlc2VhcmNoL3RlY2huaWNhbC1hbmFseXNpcy1kYXJrdmlzaW9uLXJhdFwiPjxsaW5rIGhyZWY9XCJodHRwczovL3d3dy56c2NhbGVyLmNvbS9ibG9ncy9zZWN1cml0eS1yZXNlYXJjaC90ZWNobmljYWwtYW5hbHlzaXMtZGFya3Zpc2lvbi1yYXRcIiByZWw9XCJhbHRlcm5hdGVcIiBocmVmbGFuZz1cImVuXCI%2BPGxpbmsgaHJlZj1cImh0dHBzOi8vd3d3LnpzY2FsZXIuY29tL2ZyL2Jsb2dzL3NlY3VyaXR5LXJlc2VhcmNoL3RlY2huaWNhbC1hbmFseXNpcy1kYXJrdmlzaW9uLXJhdFwiIHJlbD1cImFsdGVybmF0ZVwiIGhyZWZsYW5nPVwiZW4tZnJcIj48bGluayBocmVmPVwiaHR0cHM6Ly93d3cuenNjYWxlci5jb20vZGUvYmxvZ3Mvc2VjdXJpdHktcmVzZWFyY2gvdGVjaG5pY2FsLWFuYWx5c2lzLWRhcmt2aXNpb24tcmF0XCIgcmVsPVwiYWx0ZXJuYXRlXCIgaHJlZmxhbmc9XCJlbi1kZVwiPjxsaW5rIGhyZWY9XCJodHRwczovL3d3dy56c2NhbGVyLmNvbS9pdC9ibG9ncy9zZWN1cml0eS1yZXNlYXJjaC90ZWNobmljYWwtYW5hbHlzaXMtZGFya3Zpc2lvbi1yYXRcIiByZWw9XCJhbHRlcm5hdGVcIiBocmVmbGFuZz1cImVuLWl0XCI%2BPGxpbmsgaHJlZj1cImh0dHBzOi8vd3d3LnpzY2FsZXIuY29tL2pwL2Jsb2dzL3NlY3VyaXR5LXJlc2VhcmNoL3RlY2huaWNhbC1hbmFseXNpcy1kYXJrdmlzaW9uLXJhdFwiIHJlbD1cImFsdGVybmF0ZVwiIGhyZWZsYW5nPVwiZW4tanBcIj48bGluayBocmVmPVwiaHR0cHM6Ly93d3cuenNjYWxlci5jb20vbXgvYmxvZ3Mvc2VjdXJpdHktcmVzZWFyY2gvdGVjaG5pY2FsLWFuYWx5c2lzLWRhcmt2aXNpb24tcmF0XCIgcmVsPVwiYWx0ZXJuYXRlXCIgaHJlZmxhbmc9XCJlbi1teFwiPjxsaW5rIGhyZWY9XCJoIl0sWy0xMiwibnVsbCJdLFstMjIsIltcIm5cIixcIm5cIl0iXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTM4LCJpLC0xLC0xLDEsMCwwLDAsNTYsMjYsMTI1LC0xLDAsNDQ3LjgsNDQ3LjgsNzUzLDc1MyJdLFstNTYsImxhbmRzY2FwZS1wcmltYXJ5Il0sWy01OCwiLSJdLFstNiwie1wid1wiOltcIjFcIl0sXCJuXCI6W10sXCJkXCI6W119Il0sWy0xMywiLSJdLFstMTYsIjAiXSxbLTI3LCJbNTAsMTAsMCxcIjRnXCIsbnVsbF0iXSxbLTI5LCItIl0sWy0zOSwiW1wiMjAwMzAxMDdcIiwyLFwiR2Vja29cIixcIk5ldHNjYXBlXCIsXCJNb3ppbGxhXCIsbnVsbCxudWxsLHRydWUsOCxmYWxzZSxudWxsLDUsdHJ1ZSx0cnVlLG51bGwsMCx0cnVlLHRydWVdIl0sWy02MSwie1wid2dzbFwiOlwiNDtwYWNrZWRfNHg4X2ludGVnZXJfZG90X3Byb2R1Y3Q7dW5yZXN0cmljdGVkX3BvaW50ZXJfcGFyYW1ldGVycztwb2ludGVyX2NvbXBvc2l0ZV9hY2Nlc3M7cmVhZG9ubHlfYW5kX3JlYWR3cml0ZV9zdG9yYWdlX3RleHR1cmVzO1wiLFwicGNmXCI6XCJiZ3JhOHVub3JtXCJ9Il0sWy03MCwiLSJdLFszNywiWzMzMTYyMjQwNDksZnVuY3Rpb24obmV3VmFsdWUpIHtcbiAgICAgICAgICAgICAgYWRkQ29udGVudFdpbmRvd1Byb3h5KHRoaXMpXG4gICAgICAgICAgICAgIC8vIFJlc2V0IHByb3BlcnR5LCB0aGUgaG9vayBpcyBvbmx5IG5lZWRlZCBvbmNlXG4gICAgICAgICAgICAgIE9iamVjdC5kZWZpbmVQcm9wZXJ0eShpZnJhbWUsICdzcmNkb2MnLCB7XG4gICAgICAgICAgICAgICAgY29uZmlndXJhYmxlOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB3cml0YWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgdmFsdWU6IF9zcmNkb2NcbiAgICAgICAgICAgICAgfSlcbiAgICAgICAgICAgICAgX2lmcmFtZS5zcmNkb2MgPSBuZXdWYWx1ZVxuICAgICAgICAgICAgfV0iXSxbLTUsIi0iXSxbLTE4LCJbMCwwLDAsMV0iXSxbLTIxLCItIl0sWy00MCwiMzMiXSxbLTQ1LCI2MjAsNjc3LDAsMCwwLDU2MiwwLDAsNjQ4LDAsMCwwLDAsMCwwLDAsMCwwLDAsNjg0LDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwIl0sWy00OCwiMCwwIl0sWy01MywiMTAwIl0sWy02NCwiWzAsXCJcIixbXV0iXSxbLTIwLCItIl0sWy00MSwiLSJdLFstNTksImRlZmF1bHQiXSxbLTY4LCItIl0sWy00NywiUGFjaWZpYy9Ib25vbHVsdSxlbi1VUyxsYXRuLGdyZWdvcnkiXSxbLTQ5LCItIl0sWy02NSwiLSJdLFstOCwiLSJdLFstMTcsIjE2Il0sWy0zNSwiWzE3MjkwNDQ4NTc1MDIsMTBdIl0sWy01NSwiMiJdLFstNjcsIi0iXSxbLTE1LCItIl0sWy0yNiwie1widGpoc1wiOjI3MjcwOTE5LFwidWpoc1wiOjIwOTk3NTE1LFwiamhzbFwiOjQyOTQ3MDUxNTJ9Il0sWy0yOCwiZW4tVVMsZW4iXSxbLTM0LCItIl0sWy0zNiwiW1wiNC8zXCIsXCI0LzNcIl0iXSxbLTEwLCItIl0sWy0xOSwiWzIwLDIwLDIwLDIwLDAsMCwxLDI0LDI0LFwiLVwiLDE2MDAsMTIwMCwxNjAwLDEyMDAsMTYwMCwxMjg1LDE2MDAsMTIwMCwwLDAsMCwwLFwiLVwiLFwiLVwiLDE2MDAsMTIwMF0iXSxbLTI1LCItIl0sWy00MywiMDAwMDAwMDEwMTAwMDAwMTAwMTExMDExMDAxMDExMDEwMDAwMDEwIl0sWy01MSwiLSJdLFstNjMsIi0iXSxbLTI0LCJbXSJdLFstMzIsIi0iXSxbLTMzLCItIl0sWy00NCwiMCwwLDAsNSJdLFstNjAsMjA3XSxbMTIsIntcImN0eFwiOlwid2ViZ2xcIixcInZcIjpcImludGVsIGluYy5cIixcInJcIjpcImludGVsIGlyaXMgb3BlbmdsIGVuZ2luZVwiLFwic2x2XCI6XCJ3ZWJnbCBnbHNsIGVzIDEuMCAob3BlbmdsIGVzIGdsc2wgZXMgMS4wIGNocm9taXVtKVwiLFwiZ3ZlclwiOlwid2ViZ2wgMS4wIChvcGVuZ2wgZXMgMi4wIGNocm9taXVtKVwiLFwiZ3ZlblwiOlwid2Via2l0XCIsXCJiZW5cIjo3LFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MTkzMDgyMDI3OSxcInNlY1wiOlwiXCJ9Il0sWy03LCItIl0sWy05LCIrIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwidHdpdHRlcjp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiXX0iXSxbLTE0LCItIl0sWy0zNywiLTE0NC02Ni0xODAtIl0sWy00MiwiMTcyNDI5NzY1MyJdLFstNDYsIjAiXSxbLTUwLCItIl0sWy02MiwiODAiXSxbLTcxLCJhMDExMDAxMDEwMDEwMDEwMTAwMDEwMTAwMTExMTEwMTAwMDAxMCJdLFsiYm5jaCIsMjM5XSxbLTEsIi0iXSxbLTIsIjcsZUFIV1gxL2YzcXpDdmJrdXltUXdnbElhRjNwSXNnSUlqU1ErOGlLZ3FJMG9zSUFpcEZFRVFSSWtVZ2RFUVFwVW9KU0F0Q0FxU0g5R3l5N1pXWitlci9kK2U5MmJ3c0NTRC8xZSJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstMjMsIisiXSxbLTMxLCJmYWxzZSJdLFstNTIsIi0iXSxbLTU0LCJ7XCJoXCI6W1wiXzNcIixcIjI4NzI4OTkzMjBcIixcIl8xXCIsXCI3NjY3NjMxOFwiXSxcImRcIjpbXSxcImJcIjpbXCIxMTc2NzI4Nzg3XCIsXCIxOTg2MDY1MzkzXCIsXCJfMlwiLFwiMjgzMjYwMjY3OFwiXSxcInNcIjoxfSJdLFstNTcsIldFMFpWMXhPY1ZoWFhWVmNTeGNGV2xaVVNVeE5YRjBIR1dKWVNobFlTVWxWUUdRWkVWeFBXRlVaV0UwWkJWaFhWbGRBVkZaTVNnY1pFUU1PQXdnTUNRb0pBUkFWR1FWWVYxWlhRRlJXVEVvSEF3Z0JBd29KRUJWWVRSbDRTMHRZUUJkS1hCa1JVVTFOU1VvREZoWldXeGRRU2x4WVNsSlFYRW9YV2xaVUZsQVdDQW9BREZ3TURWc09DVnNKRDFzTkRRMFBEQTlZQzE4TkNWb0lDZ3dLRGcwWFUwb0RDQU1QQVFnSURSQVZXRTBaU3hrUlVVMU5TVW9ERmhaV1d4ZFFTbHhZU2xKUVhFb1hXbFpVRmxBV0NBb0FERndNRFZzT0NWc0pEMXNORFEwUERBOVlDMThOQ1ZvSUNnd0tEZzBYVTBvRENBTU9DdzRPRFJBPSJdLFstNjYsImdlb2xvY2F0aW9uLGNodWFmdWxsdmVyc2lvbmxpc3QsY3Jvc3NvcmlnaW5pc29sYXRlZCxzY3JlZW53YWtlbG9jayxwdWJsaWNrZXljcmVkZW50aWFsc2dldCxzaGFyZWRzdG9yYWdlc2VsZWN0dXJsLGNodWFhcmNoLGNvbXB1dGVwcmVzc3VyZSxjaHByZWZlcnNyZWR1Y2VkdHJhbnNwYXJlbmN5LHVzYixjaHNhdmVkYXRhLHB1YmxpY2tleWNyZWRlbnRpYWxzY3JlYXRlLHNoYXJlZHN0b3JhZ2UscnVuYWRhdWN0aW9uLGNodWFmb3JtZmFjdG9ycyxjaGRvd25saW5rLG90cGNyZWRlbnRpYWxzLHBheW1lbnQsY2h1YSxjaHVhbW9kZWwsY2hlY3QsYXV0b3BsYXksY2FtZXJhLHByaXZhdGVzdGF0ZXRva2VuaXNzdWFuY2UsYWNjZWxlcm9tZXRlcixjaHVhcGxhdGZvcm12ZXJzaW9uLGlkbGVkZXRlY3Rpb24scHJpdmF0ZWFnZ3JlZ2F0aW9uLGludGVyZXN0Y29ob3J0LGNodmlld3BvcnRoZWlnaHQsbG9jYWxmb250cyxjaHVhcGxhdGZvcm0sbWlkaSxjaHVhZnVsbHZlcnNpb24seHJzcGF0aWFsdHJhY2tpbmcsY2xpcGJvYXJkcmVhZCxnYW1lcGFkLGRpc3BsYXljYXB0dXJlLGtleWJvYXJkbWFwLGpvaW5hZGludGVyZXN0Z3JvdXAsY2h3aWR0aCxjaHByZWZlcnNyZWR1Y2VkbW90aW9uLGJyb3dzaW5ndG9waWNzLGVuY3J5cHRlZG1lZGlhLGd5cm9zY29wZSxzZXJpYWwsY2hydHQsY2h1YW1vYmlsZSx3aW5kb3dtYW5hZ2VtZW50LHVubG9hZCxjaGRwcixjaHByZWZlcnNjb2xvcnNjaGVtZSxjaHVhd293NjQsYXR0cmlidXRpb25yZXBvcnRpbmcsZnVsbHNjcmVlbixpZGVudGl0eWNyZWRlbnRpYWxzZ2V0LHByaXZhdGVzdGF0ZXRva2VucmVkZW1wdGlvbixoaWQsY2h1YWJpdG5lc3Msc3RvcmFnZWFjY2VzcyxzeW5jeGhyLGNoZGV2aWNlbWVtb3J5LGNodmlld3BvcnR3aWR0aCxwaWN0dXJlaW5waWN0dXJlLG1hZ25ldG9tZXRlcixjbGlwYm9hcmR3cml0ZSxtaWNyb3Bob25lIl0sWy02OSwiTGludXggeDg2XzY0fEdvb2dsZSBJbmMufDh8MTZ8fDAiXSxbImRkYiIsIjAsNywwLDQsMSwyLDAsMCwwLDAsMSwxLDAsMCwzLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDEsMCwwLDAsMCwwLDEsMiwxNywxLDEsMCwwLDAsMCwwLDEsMCwxLDAsMCwzLDAsOCwwLDAsMCwwLDAsMCwwLDAsMCwxLDAiXSxbImNiIiwiMCwwLDAsMCwwLDAsMCwwLDEsMSwwLDAsNywxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDgsMCwwLDAsMCwwLDAsMCwwLDAsMCJdXQ%3D%3D&dep=0&pre=0&sdd=%7B%7D&cri=W1ReEyZdsi&pto=904&ver=62&gac=-&mei=&ap=&fe=1&duid=1.1729044857.wEZK7vXGLDkcdEMH&suid=1.1729044857.EpsesYkLJN275xNr&tuid=1.1729044857.i1rZNdt0j7VRfRNK&fbc=-&gtm=W10%3D&it=67%2C184%2C142&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 460397d5eb09c20821968031b70313c6ca4dcd40c6ee2a65f0f1aec1682d4c43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: https://www.zscaler.com
content-encoding: gzip
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
content-length: 1344
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: text/javascript

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 47ms
14ms Script
application/x-javascript 23.13.172.203
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-172-203.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Content-Encoding: gzip
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Wed, 16 Oct 2024 02:14:17 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 6934ae2b-4c76-4229-97d0-8f637b004b88.js Show response
j.6sc.co/j/ 4 KB
2 KB 120ms
30ms Script
application/javascript 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-205-106-73.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
etag: "afb8c61166e7f50fe6d7ab7b6377733c"
x-amz-version-id: uLuCr1hhLpJjZt0sFSB89FSJa4YqIrE7
expires: Wed, 16 Oct 2024 02:44:17 GMT
x-amz-cf-id: G4h9Mc3WkU4d0t-voMD87CrloD2SJ1z5nyZurJ1yfDsRIihFmJ2lZg==
date: Wed, 16 Oct 2024 02:14:17 GMT
last-modified: Tue, 02 May 2023 17:36:47 GMT
vary: Accept-Encoding
content-type: application/javascript
x-amz-meta-content-type: application/json
cache-control: private, max-age=1800
accept-ranges: bytes
content-length: 1178
x-amz-cf-pop: IAD50-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b49a-7878-8885-fa7280aa0284/ 208 KB
36 KB 32ms
31ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b49a-7878-8885-fa7280aa0284/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f601a9f9aa789f9fbae4bcc96bdaf96b93afe7b7f74ec52dc03f89141cd08c6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: UoWwujX9k65MHFOtihU0ww==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE50A478CCB37
age: 65762
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 17 Oct 2024 02:14:17 GMT
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/json
last-modified: Sat, 05 Oct 2024 06:52:29 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: ae05689f-e01e-00e3-4ff3-167605000000
cf-ray: 8d3488d90fad43bb-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36187
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 storage.html
117186981.intellimizeio.com/ Frame 36F2 0
0 90ms
21ms Document
text/html 18.204.24.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://117186981.intellimizeio.com/storage.html

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.204.24.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-204-24-143.compute-1.amazonaws.com

Software

/ Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 5628
content-type: text/html; charset=utf-8
date: Wed, 16 Oct 2024 02:14:17 GMT
etag: W/"15fc-Uk1A5QrccB7iUltcerqKsVx8Uo0"
strict-transport-security: max-age=15552000; includeSubDomains
x-powered-by: Express

POST
H2 200 117186981 Show response
api.intellimize.co/context-v2/ 576 B
654 B 127ms
79ms Fetch
application/json 3.216.162.62
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/context-v2/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.216.162.62 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-216-162-62.compute-1.amazonaws.com

Software

Resource Hash

21586cef75b1d6452c110a74f35d5d6d3a271524abdb0cd48572daee4f68a505

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET 04f9a63c-be9b-4314-b955-550e552be8ef
https://www.zscaler.com/ Frame 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 349 KB
114 KB 34ms
33ms Script
application/javascript 2607:f8b0:400d:c03::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c03::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aa2b70b04543725807e31004736e56d24f392324656e1559a9a212cbe468f4af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 16 Oct 2024 02:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 116047
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 345 KB
112 KB 45ms
45ms Script
application/javascript 2607:f8b0:400d:c03::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c03::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e2c709d3d9a6dade8bb17a7469e0c5a374b804b8bf9939f9d93de19725b371d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 16 Oct 2024 02:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 115046
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 227 KB
58 KB 35ms
15ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5bbd9766838bf11e3ff360ec5cbb60d6ada352fbad7f7691e24f847313b9b1d4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=23, mss=1232, tbw=4471, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: j58QFXGF9F9xzcxGh0CWPvWhGf9o3k2UU+hZxmWXX0S3HpekNykaSshF0GbpIoEbPAxl/hI+cakqAqPfCDlHgQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59352
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 98ms
21ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

c3be590171c0375d497714a608a5c4cd4e90e124e1c0cff1807cd8adb156e64b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "01973e1111cdb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CDF747DF92F6448DBD3CB3DE88889167 Ref B: EWR30EDGE1115 Ref C: 2024-10-16T02:14:18Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14538
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript
last-modified: Fri, 11 Oct 2024 19:15:06 GMT
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 292 KB
97 KB 57ms
56ms Script
application/javascript 2607:f8b0:400d:c03::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c03::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

38ed79d11d70280ff8dae23dae491b49b0f365a99aa9c1b1d05ef03068429abc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 16 Oct 2024 02:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 16 Oct 2024 00:43:33 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99521
x-xss-protection: 0
server: Google Tag Manager

GET
H3

200

/
www.google.com/pagead/1p-conversion/812494211/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=354250153&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWx...
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=354250153&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd...

42 B
64 B

75ms
31ms

Image
image/gif

2607:f8b0:400d:c0c::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=354250153&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI4PnBhOqRiQMVk1lHAR17iyjKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwDpaXnfNnAx7Wa1XVuxVqOPXvJVL6teZYBfNg&random=2929047499

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Server

2607:f8b0:400d:c0c::63 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=354250153&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI4PnBhOqRiQMVk1lHAR17iyjKMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwDpaXnfNnAx7Wa1XVuxVqOPXvJVL6teZYBfNg&random=2929047499
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 tc_imp.gif
obs.iseaskies.com/tracker/ 43 B
79 B 17ms
16ms Image
image/gif 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.iseaskies.com/tracker/tc_imp.gif?e=37dfbd8ee84e001268e7c731ee4f8f9a9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5811896d2e17071a10acf9f29f674f83d688052c3f19f9797e528533d63394513103269500050c3c515cc7ed6d4877be26bb25cb43e2916af00665a90b2d7a1bda53ee42f496d2df3dbb2907fe7ccafe5264d80e634175169380056ca460b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c44ca4825b6a3e5aa22a76da50eda7cf54a6863c89777256e1d0cd71ed0d906f50732e690b73255015ab2fb523c9bdc05457f54065258fcd135700e5fe6a5142c93aaf7278ee04572032cbbc5f4c2c935e7c2db59ec489f5e2c7edfaacff4e43e828ae76f91650b83fa9d2f1d1ef66039a1c21c62b88bad208903ab43b2844eca4ed9d36d9a6d279c9b22da6198cefab6cdb3f11338ae6bf2fbb9234e2bfb94248efe01e0141a54954309da8dcec8cff18021853bd79fa29873f867342483692c978490446ac6ef72a10dec924e9838ac7141454fdd3dae42dac4be76ac8c29cc11ebc0ccd871ce17046bfa1e4c0030096ec0af72b9499494d675fed025fcd0749ab5d8be33cfb0a7073530c8fe5d0483e4471a12f3e8e524e66fd8f856fdf232a02ff8239f41874c82e938875a74f6b280386e7939547b4f0548f4f3867e8c10ab5719125aa4ed1a81dc6158ecb2cda7ae70d0bbb68fdaa1faaf0f3668e94d94ab4b7291013909dd085e7265ea78ad7005c3ebc1638a7cd6258bab2fd1b90d997b0b3d21027c139bdce5db3c795d86194595d0d8a7b1ca530699acbc618bcc7b78c4cf113b60e58cd85523ab3a835f9e77ff2dcf57829c01f2a833fc9a8fd0914766ebe83e649c31d3e7cbac50f41b48625ec73c362dc9b1439daf5193cd89c246cc9986340c3e47ba39a300ad4bc7c12ac3712a7a3d40037de65fc6ff7147a57d84e2ac61cbc55f8d6a72a813752c9becd90f5df028f4cc7aa453750010bb5d4ed4cda913d94b2cd8c545b3d5b6929c5098190c301ff26b3706cdd45d20e56fb6ba9872d1b1b9590423fc782a0918dd4305a48be41b12997e6393cad653c3d5a6dd197fef72a90d6955c552313f8892164b8bcaf189a1e142f330a772c77a82dc5786fff22834e69a529dddedf0d6f9d6d1261bdab3375f9a23805bde4cebed2ba8c6d1c728f1ff958aa71928cfb8b8a951cb02d90e55375f&cri=W1ReEyZdsi&ts=354&cb=1729044857968
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
date: Wed, 16 Oct 2024 02:14:17 GMT
pragma: no-cache
content-type: image/gif

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 15ms
15ms Script
application/x-javascript 23.13.172.203
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-172-203.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Fri, 24 Jan 2025 02:14:17 GMT
Accept-Ranges: bytes
Content-Length: 4741
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Wed, 16 Oct 2024 02:14:17 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 21ms
20ms Script
application/javascript 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111d7"
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 05:14:17 GMT
accept-ranges: bytes
content-length: 18830
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 13 KB
3 KB 22ms
20ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: RGlYb2KBTfdkPpxIxwwu0g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCECBD3EA86C79
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 65763
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
last-modified: Tue, 15 Oct 2024 02:01:12 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: b0dd4b37-001e-0007-23cf-1e650f000000
cf-ray: 8d3488da9a2743bb-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3003
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 5 KB
2 KB 27ms
24ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: fyGpUoUy0eZkGUgUg6MkZA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCECBD3FAF8D26
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 65763
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
last-modified: Tue, 15 Oct 2024 02:01:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 89663263-701e-00cf-36cf-1ef438000000
cf-ray: 8d3488da9a2943bb-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1738
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 24 KB
4 KB 25ms
22ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 55627
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/css
last-modified: Tue, 15 Oct 2024 02:01:23 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 4f759ec8-301e-00c3-1ccf-1e1ac9000000
cf-ray: 8d3488da9a2b43bb-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET 915bc574-c248-45f6-8840-ebd1e8eed6e7
https://www.zscaler.com/ Frame 0
0

POST
H/1.1 200
OK visitWebPage
306-zej-256.mktoresp.com/webevents/ 2 B
318 B 117ms
19ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://306-zej-256.mktoresp.com/webevents/visitWebPage?_mchNc=1729044858081&_mchCn=&_mchId=306-ZEJ-256&_mchTk=_mch-zscaler.com-1729044858080-82578&_mchHo=www.zscaler.com&_mchPo=&_mchRu=%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: e86b4c07-895a-4af2-9ce0-94f1597e1140
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Wed, 16 Oct 2024 02:14:18 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 6 KB
2 KB 370ms
369ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=7971&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&callback=jQuery37102139318446185965_1729044857744&_=1729044857745
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9666d336fc9a09dbc23d8d179db0e470d9c26cd43400498735ede735a455e3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cached: false
x-form-service-request-id: 16911#192931ac533
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8d3488db1ef84297-EWR
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-marketo-source: Form Service
server: cloudflare

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 6 KB
2 KB 309ms
309ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=1944&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&callback=jQuery37102139318446185965_1729044857746&_=1729044857747
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58af6a55b4d2c0952761f52771f0f037d7c75dacd825000870666c96c3d61d04

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cached: false
x-form-service-request-id: 356a#192931ac531
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8d3488db1efd4297-EWR
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-marketo-source: Form Service
server: cloudflare

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
700 B 134ms
115ms XHR
application/json 68.67.179.166
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.166 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.132; 5.181.234.132; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
an-x-request-uuid: a76382b8-a9f3-4b50-a55e-ad24df5c8ab3
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 / Show response
c.6sc.co/ 7 B
193 B 57ms
14ms XHR
text/html 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-205-106-73.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.zscaler.com
content-length: 7
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 37 B
340 B 90ms
15ms XHR
text/html 2600:1408:ec00:2e::1735:ba8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:2e::1735:ba8 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 3e6007d6444da0a1f070d77c5c8601eb12f378116c62f7bd19100fd2d536860d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a0d:5600:24:1500:1012:f79f:b24b:f78a
expires: Wed, 16 Oct 2024 02:14:18 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729044858155_389185960_2320043031_14_601_13_18_219";dur=1
access-control-allow-origin: https://www.zscaler.com
content-length: 37
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/html
vary: Origin

GET
H3 200 1778897272132032 Show response
connect.facebook.net/signals/config/ 77 KB
15 KB 15ms
15ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1778897272132032?v=2.9.171&r=stable&domain=www.zscaler.com&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C28%2C82%2C87%2C47%2C46%2C86%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fa57cc17f597f4002dca2c06225b619ecb9495ee44220d429d4f16d945a3c50f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=74, mss=1232, tbw=67733, tp=65, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: loSgXsOOwh/7tCVOI+f5D0rNF8qeOG58Y3ZSR0XDpM63L5TW9Msp7jPMECYZN7W2u5SjbSaNfMDjIXGm6evDnA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 15458
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 200 117186981 Show response
api.intellimize.co/prediction/ 68 B
379 B 23ms
21ms Fetch
application/json 3.216.162.62
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/prediction/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.216.162.62 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-216-162-62.compute-1.amazonaws.com

Software

Resource Hash

7f2f71c135382ff59ca61fba520b789d9889aa25fd0adca0d3a31182b791569b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/ 5 KB
2 KB 36ms
36ms Script
text/javascript 2607:f8b0:400d:c0f::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1729044858274&cv=11&fst=1729044858274&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f5b5463aac4c4d4853bb016bf14743481a63cfe8cff29cc74de6fc2c4f9edc17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2382
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 812494211
td.doubleclick.net/td/rul/ Frame 3695 0
0 78ms
32ms Document
text/html 2607:f8b0:400d:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/812494211?random=1729044858274&cv=11&fst=1729044858274&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 16 Oct 2024 02:14:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/812494211/ 5 KB
3 KB 35ms
35ms Script
text/javascript 172.217.197.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/812494211/?random=1729044858331&cv=11&fst=1729044858331&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&gtm_ee=1&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.197.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qa-in-f156.1e100.net

Software

cafe /

Resource Hash

4e1efebf2f7bd2d57fdd45684a06de77b0141b8f17c6a3d1a3fb8fa48d24e4dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2684
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 812494211
td.doubleclick.net/td/rul/ Frame BB81 0
0 74ms
40ms Document
text/html 2607:f8b0:400d:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/812494211?random=1729044858331&cv=11&fst=1729044858331&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&gtm_ee=1&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 16 Oct 2024 02:14:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 19ms
18ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=ipv6&q=%7B%22address%22%3A%222a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:18 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 17ms
16ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:18 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 19ms
19ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22ab9750bca4342498694e239e304dd3a9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%221dc729230d6b8d19bab5e6236d81f60c4dca0823%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%226934ae2b-4c76-4229-97d0-8f637b004b88%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:18 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 295018432.js Show response
bat.bing.com/p/action/ 370 B
424 B 23ms
22ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/295018432.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7f47f02c93d5de5de03db0ebffa39fe1060767437b086996e295c9818a05b2f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 179253DE4F2248E89DDC073233FA07B4 Ref B: EWR30EDGE1115 Ref C: 2024-10-16T02:14:18Z
x-cache: CONFIG_NOCACHE
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 207 KB
74 KB 29ms
28ms Script
application/javascript 2607:f8b0:400d:c03::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

395dff1fe3ef19d63bb810df5654c8a71b290f165dca4f7f461bf2ac2367304b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 16 Oct 2024 02:14:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 16 Oct 2024 00:43:33 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 76010
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
analytics.google.com/g/ 0
0 53ms
22ms Fetch
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je4ae0v883639532za200zb71607006&_p=1729044857329&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101529666~101686685&cid=514359380.1729044858&ecid=88403871&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1729044858&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&dt=DarkVision%20RAT%20%7C%20ThreatLabz&en=CQ&_fv=1&_nsi=1&_ss=1&_ee=1&up.cq_category=bots&tfd=1704
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
554 B 69ms
21ms Ping
text/plain 2607:f8b0:400d:c0d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-10SPJ4YJL9&cid=514359380.1729044858&gtm=45je4ae0v883639532za200zb71607006&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101529666~101686685
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0d::9d Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 6053 0
0 29ms
27ms Document
text/html 2607:f8b0:400d:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-10SPJ4YJL9&gacid=514359380.1729044858&gtm=45je4ae0v883639532za200zb71607006&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101529666~101686685&z=602196190

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 16 Oct 2024 02:14:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 660 B
587 B 76ms
46ms XHR
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 0b96905923d1c096be22beb729fe7f5e4b7f1ca4e8787c5a412c28986094c28f

Request headers

Authorization: Token 1dc729230d6b8d19bab5e6236d81f60c4dca0823
X-6s-CustomID: WebTag 6934ae2b-4c76-4229-97d0-8f637b004b88
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.zscaler.com
content-length: 328
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 53ms
16ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.zscaler.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Wed, 16 Oct 2024 02:14:18 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 53ms
14ms Image
text/plain 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&rl=&if=false&ts=1729044858453&sw=1600&sh=1200&v=2.9.171&r=stable&ec=0&o=4126&fbp=fb.1.1729044858451.5809525985875096&ler=empty&cdl=API_unavailable&it=1729044858145&coo=false&exp=h3&rqm=GET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=10, mss=1328, tbw=2975, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 120ms
82ms Image
image/png 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&rl=&if=false&ts=1729044858453&sw=1600&sh=1200&v=2.9.171&r=stable&ec=0&o=4126&fbp=fb.1.1729044858451.5809525985875096&ler=empty&cdl=API_unavailable&it=1729044858145&coo=false&exp=h3&rqm=FGET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7426191118942555677"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: zMKeYiU6jC9h36GBTZSuSZcF7YNG0B2x+rp4jZ53FVQoeSVbja7QrtMilbWiHcVxJ9+QA+rTc4wsYvued0OTYQ==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7426191118942555677", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=14, mss=1328, tbw=3293, tp=-1, tpl=-1, uplat=67, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

POST
H2 200 logger
log.intellimize.co/ 3 B
315 B 274ms
81ms Ping
application/json 35.81.243.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.81.243.85 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-81-243-85.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 logger
log.intellimize.co/ 3 B
325 B 274ms
81ms Ping
application/json 35.81.243.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.81.243.85 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-81-243-85.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H3 200 /
www.google.com/pagead/1p-user-list/812494211/ 42 B
64 B 27ms
27ms Image
image/gif 2607:f8b0:400d:c0c::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/812494211/?random=1729044858274&cv=11&fst=1729044000000&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnf9e7vH_zbDgWxjc9KHqgrNYUbpkdhejzuj5DDcE2PJVgjZDK0&random=3044804537&rmt_tld=0&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::63 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3

200

/
www.google.com/pagead/1p-conversion/812494211/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1371874676&cv=11&fst=1729044858331&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l...
https://www.google.com/pagead/1p-conversion/812494211/?random=1371874676&cv=11&fst=1729044858331&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=10152...

42 B
64 B

29ms
28ms

Image
image/gif

2607:f8b0:400d:c0c::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/812494211/?random=1371874676&cv=11&fst=1729044858331&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&gtm_ee=1&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIjsvUhOqRiQMV3GJHAR0MNAdAMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUk4S1c0dUFZUXctbU4tdktEbUwzWkFSSXNBT2MzQTRDdF9qWXRpTHlpaFYtdk1lNnBWUWZaVzFveTNZY3lZWHctdEpzMzdYSTMzdk5nWmNQQTdhaw&is_vtc=1&cid=CAQSKQDpaXnf8z1BZWIEwd6N5mVtKa0C0A5Z409UNTUIXMAb4KBq-ticM5Ik&random=4098851899

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Server

2607:f8b0:400d:c0c::63 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/812494211/?random=1371874676&cv=11&fst=1729044858331&bg=ffffff&guid=ON&async=1&gtm=45be4ae0v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=DarkVision%20RAT%20%7C%20ThreatLabz&gtm_ee=1&npa=0&pscdl=noapi&auid=1077010013.1729044858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIjsvUhOqRiQMV3GJHAR0MNAdAMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUk4S1c0dUFZUXctbU4tdktEbUwzWkFSSXNBT2MzQTRDdF9qWXRpTHlpaFYtdk1lNnBWUWZaVzFveTNZY3lZWHctdEpzMzdYSTMzdk5nWmNQQTdhaw&is_vtc=1&cid=CAQSKQDpaXnf8z1BZWIEwd6N5mVtKa0C0A5Z409UNTUIXMAb4KBq-ticM5Ik&random=4098851899
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Wed, 16 Oct 2024 02:14:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 forms2.css
info.zscaler.com/js/forms2/css/ 13 KB
3 KB 27ms
26ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "2f4027b-3437-62370c030d900"
age: 685
x-content-type-options: nosniff
cf-ray: 8d3488dd7a174297-EWR
expires: Wed, 16 Oct 2024 06:14:18 GMT
accept-ranges: bytes
content-length: 2623
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-round.css
info.zscaler.com/js/forms2/css/ 4 KB
1 KB 32ms
31ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2-theme-round.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "30111f-e46-62370c030d900"
age: 468
x-content-type-options: nosniff
cf-ray: 8d3488dd7a194297-EWR
expires: Wed, 16 Oct 2024 06:14:18 GMT
accept-ranges: bytes
content-length: 968
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 66ms
21ms Script
text/javascript 2607:f8b0:400d:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::8a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
age: 5522
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:42:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 00:42:16 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 XDFrame Show response
info.zscaler.com/index.php/form/ Frame 6C39 2 KB
735 B 41ms
41ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/index.php/form/XDFrame

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8d3488de1ad44297-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 16 Oct 2024 02:14:18 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 110ms
24ms Preflight
application/json 18.67.76.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.76.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-13.iad89.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Wed, 16 Oct 2024 02:14:18 GMT
via: 1.1 d3cd567650e598ded7d5dd9266aa396c.cloudfront.net (CloudFront)
x-amz-apigw-id: fuIrNH6BoAMEmgQ=
x-amz-cf-id: b6NPuSEen3w-AtABsdQ-lodkzPfLWehTotiTZWxqgPxketJhoUjCcQ==
x-amz-cf-pop: IAD89-P2
x-amzn-requestid: b3bb89d7-8919-4f5c-91b8-e56548016c34
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
520 B 80ms
78ms XHR
application/json 18.67.76.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.76.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-13.iad89.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.zscaler.com/

Response headers

x-amz-apigw-id: fuIrOHv8IAMEMiw=
x-amzn-trace-id: Root=1-670f217a-05c338f37dda78ac38e3f87d;Parent=4b07379bc5da54e4;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 6e134443-914b-42fa-be20-bc78a331cdfa
via: 1.1 d3cd567650e598ded7d5dd9266aa396c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: 86qyDuYTvCCiJaMB093EimDMQV-kr1azunRxX6ERomrL8Nb7cU-zmg==
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
x-amz-cf-pop: IAD89-P2
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 26ms
26ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1712.9000005722046%2C%22duration%22%3A130.29999923706055%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1712.9000005722046%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1843.1999998092651%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=&d=1&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:18 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
419 B 22ms
21ms XHR
text/plain 2607:f8b0:400d:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=839298296&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&ul=en-us&de=UTF-8&dt=DarkVision%20RAT%20%7C%20ThreatLabz&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=799982496&gjid=1892370906&cid=514359380.1729044858&tid=UA-6177009-1&_gid=1171936581.1729044859&_r=1&gtm=457e4ae0z8883639532za200zb883639532&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&jsscut=1&z=2111474996

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::8a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.zscaler.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 02:14:18 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ Frame 6C39 199 KB
0 0ms
0ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://info.zscaler.com/index.php/form/XDFrame

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "301128-31b91-62370c030d900"
age: 3186
x-content-type-options: nosniff
cf-ray: 8d3488d77a564297-EWR
expires: Wed, 16 Oct 2024 06:14:17 GMT
date: Wed, 16 Oct 2024 02:14:17 GMT
content-type: application/x-javascript
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 126ms
82ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
etag: W/"b2877da906a3216c4f3fc4030b205e54"
age: 65092
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: AMthglmOHSp9Rx4Mjn5OXDsOD6vOtBAtRaw34AIV0sGfrZmpN4yoRA==
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/javascript
last-modified: Thu, 18 Jul 2024 08:13:46 GMT
vary: Accept-Encoding
server-timing: cfExtPri
via: 1.1 fc34781ab7aa403dba42cfccdb88981a.cloudfront.net (CloudFront)
cf-ray: 8d3488df0ab24301-EWR
x-amz-cf-pop: JFK52-P8
server: cloudflare

GET
H2 200 favicon-32x32.ico
www.zscaler.com/favicons/ 4 KB
1 KB 125ms
125ms Other
image/vnd.microsoft.icon 2606:4700::6812:1d4a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/favicons/favicon-32x32.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"875ed25f85201afbfc383f6b833f32c5-ssl"
age: 28725
x-content-type-options: nosniff
cf-ray: 8d3488ded96043dc-EWR
x-nf-request-id: 01JA9HNHTG6JTJMY70X4E5QGD3
date: Wed, 16 Oct 2024 02:14:18 GMT
cache-status: "Netlify Edge"; hit
content-type: image/vnd.microsoft.icon
server: cloudflare

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
599 B 211ms
211ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6584ddedd6dd4acfecb27bb596999762a6d336a9aaae8e31ab477e1c9b4bed14

Request headers

Authorization: Bearer e6609b6e9a1669129391
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"cb-8AQasll8MeqN4QbSHG4r03GTt0k"
apigw-requestid: fuIrRhxKvHcESIw=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: -3ltt6abcCl3sjVVv0xvUejwB6UK6RErox7675dmFRQeW6H6sj3INA==
date: Wed, 16 Oct 2024 02:14:19 GMT
content-type: application/json; charset=utf-8
vary: Origin
server-timing: cfExtPri
via: 1.1 e313693179ab4339368ba93edb851532.cloudfront.net (CloudFront)
cf-ray: 8d3488e03e328c63-EWR
access-control-allow-origin: https://www.zscaler.com
x-amz-cf-pop: JFK52-P8
x-powered-by: Express
server: cloudflare

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 105ms
93ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.zscaler.com
alt-svc: h3=":443"; ma=86400
apigw-requestid: fuIrPhK9PHcEP1A=
cf-cache-status: DYNAMIC
cf-ray: 8d3488dfad738c63-EWR
date: Wed, 16 Oct 2024 02:14:18 GMT
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
x-amz-cf-id: uAT3oJzXC9kEm2rRf6DUR9v6d0I2roBYn3YRn7UfLIQiTblDOUH0bg==
x-amz-cf-pop: JFK52-P8
x-cache: Miss from cloudfront
x-powered-by: Express

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
147 B 21ms
19ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Wed, 16 Oct 2024 02:14:18 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 35ms
35ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A18%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:19 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:19 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ Frame 0
0 129ms
69ms Preflight
text/html 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.zscaler.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d3488e1fafdc32d-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 16 Oct 2024 02:14:19 GMT
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 90 KB
27 KB 114ms
57ms Script
application/javascript 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA==
cf-cache-status: DYNAMIC
etag: W/"006455bd44ed289ddcc403d0ecd96ab0"
age: 1987
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Wed, 16 Oct 2024 02:41:12 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 91778
server-timing: cfExtPri
date: Wed, 16 Oct 2024 02:14:19 GMT
content-type: application/javascript
last-modified: Thu, 16 May 2024 10:14:37 GMT
x-guploader-uploadid: AHmUCY3dfMtKFbH7LM5MiimqOE7brOfPF5ktyqeYERGZ0Q3tOR6IqtuW-G3HsGGSHlaz1Q3fKOY
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
cf-ray: 8d3488e1fbf5c411-EWR
x-goog-generation: 1715854477710382
server: cloudflare

GET
H3 200 / Show response
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ 3 KB
2 KB 115ms
101ms Fetch
text/javascript 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

527832aaf56cb80e17915f827d750c5e5c7bf08fd90a268486edcdf5dc402cb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: 5d2599fcb7eded6d7e861729044859
_vtok: NS4xODEuMjM0LjEzMg==
visited-url: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Referer: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 16 Oct 2024 02:14:19 GMT
content-type: text/javascript
vary: Accept-Encoding
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d3488e27f4b7d00-EWR
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 19ms
17ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Wed, 16 Oct 2024 02:14:19 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 321 B
637 B 74ms
72ms Fetch
application/json 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Authorization: bearer 370c892e688e1744cd312ed1426b3a
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"141-mLq6O+j3ZcyvZxAx4AvrvpOh24w"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 16 Oct 2024 02:14:19 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d3488e2dfa27d00-EWR
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 64ms
64ms Preflight
text/html 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.zscaler.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d3488e26b63c32d-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 16 Oct 2024 02:14:19 GMT
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET 3d278ea2-17c3-40d4-aff8-b2ff974e5a5a
https://www.zscaler.com/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 19ms
19ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:20 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:20 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 20ms
20ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A20%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:21 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:21 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 22ms
21ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Wed, 16 Oct 2024 02:14:21 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 18ms
18ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A21%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:22 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:22 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 17ms
17ms Image
image/gif 23.205.106.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=4672c9e9-9734-49ae-89c0-2d35bc08eaf4&session=359a48ea-eabe-472f-8724-71fcc9532f25&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2016%20Oct%202024%2002%3A14%3A22%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Uncover%20the%20latest%20campaign%20using%20DarkVision%20RAT%20and%20PureCrypter.%20Learn%20about%20attack%20techniques%2C%20persistence%2C%20and%20command-line%20parsing.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DarkVision%20RAT%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&pageViewId=1112ac7c-07e4-408e-83b7-3d2a0555e65b&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2a0d%3A5600%3A24%3A1500%3A1012%3Af79f%3Ab24b%3Af78a&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 02:14:23 GMT
accept-ranges: bytes
content-length: 43
date: Wed, 16 Oct 2024 02:14:23 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

POST mon
obs.iseaskies.com/ 0
0

GET
H2 200 app.js
acsbapp.com/apps/app/dist/js/ 315 KB
96 KB 112ms
46ms Script
application/javascript 2606:4700:10::6816:cc

General

Check archive.org

Show headers Download Go to

Full URL: https://acsbapp.com/apps/app/dist/js/app.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/technical-analysis-darkvision-rat
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:cc -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-goog-metageneration: 3
access-control-expose-headers: *
x-goog-hash: crc32c=1OfI5w==, md5=J0aPpAwiN3HEjj+iDpQeiQ==
cf-cache-status: HIT
etag: W/"27468fa40c223771c48e3fa20e941e89"
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Thu, 16 Oct 2025 02:14:23 GMT
x-goog-stored-content-length: 322112
date: Wed, 16 Oct 2024 02:14:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 14 Oct 2024 13:05:25 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY0qxKj9jJMl54GVYj2xM3rRNzRIGBNL_3xeWiC8Rq_QqBPKm34lJWOhvWveTLxHCnA1Kw
cache-control: public, max-age=300, must-revalidate
x-goog-storage-class: STANDARD
cf-ray: 8d3488fe7c101855-EWR
access-control-allow-origin: *
x-goog-generation: 1728911125876754
server: cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.zscaler.com
URL: https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fhazard_darkvision_rat.jpeg&w=3840&q=75

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/04f9a63c-be9b-4314-b955-550e552be8ef

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/915bc574-c248-45f6-8840-ebd1e8eed6e7

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/3d278ea2-17c3-40d4-aff8-b2ff974e5a5a

Domain: obs.iseaskies.com
URL: https://obs.iseaskies.com/mon

Verdicts & Comments Add Verdict or Comment

86 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.info.zscaler.com/	1970-01-21 00:17:26	Name: __cf_bm Value: DJTUlSOpZeR9.f0IWG3QKZVGGvzpzrS6y0VVnCy.kq4-1729044857-1.0.1.1-GxarB_XqwEqJpm6XmAl5z9Zks.K95sjTsocOZtaS0NtJP2GooW9.GAT.8aIDjoG35dmTy6GYOnOOMz493Hc88Q
.zscaler.com/	1970-01-21 02:28:48	Name: _cq_duid Value: 1.1729044857.wEZK7vXGLDkcdEMH
.zscaler.com/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1729044857.EpsesYkLJN275xNr
obs.iseaskies.com/	1970-01-21 08:21:15	Name: cg_uuid Value: 61e12002719f289ace1656b5c9e31c67
.zscaler.com/	1970-01-21 09:53:24	Name: _mkto_trk Value: id:306-ZEJ-256&token:_mch-zscaler.com-1729044858080-82578
.www.zscaler.com/	1970-01-21 09:03:00	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Tue+Oct+15+2024+16%3A14%3A18+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&consentId=a3551234-e865-43f3-b54b-20a65f014393&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Ftechnical-analysis-darkvision-rat&groups=C0004%3A0%2CC0001%3A1%2CC0005%3A0%2CC0002%3A0%2CC0003%3A0&hosts=H191%3A0%2CH118%3A0%2CH36%3A1%2CH101%3A0%2CH150%3A0%2CH151%3A0%2CH129%3A0%2CH152%3A0%2CH52%3A0%2CH154%3A0%2CH133%3A0%2CH155%3A0%2CH192%3A0%2CH156%3A0%2CH8%3A0%2CH157%3A0%2CH158%3A0%2CH159%3A0%2CH104%3A0%2CH193%3A0%2CH160%3A0%2CH161%3A0%2CH162%3A0%2CH163%3A0%2CH164%3A0%2CH105%3A0%2CH14%3A0%2CH149%3A0%2CH146%3A0%2CH166%3A0%2CH40%3A0%2CH15%3A0%2CH168%3A0%2CH194%3A0%2CH17%3A0%2CH170%3A0%2CH171%3A0%2CH172%3A0%2CH173%3A0%2CH63%3A0%2CH124%3A0%2CH174%3A0%2CH175%3A0%2CH176%3A0%2CH177%3A0%2CH178%3A0%2CH134%3A0%2CH135%3A0%2CH179%3A0%2CH147%3A0%2CH180%3A0%2CH136%3A0%2CH189%3A0%2CH130%3A0%2CH181%3A0%2CH182%3A0%2CH108%3A0%2CH83%3A0%2CH109%3A0%2CH183%3A0%2CH131%3A0%2CH184%3A0%2CH113%3A0%2CH186%3A0%2CH115%3A0%2CH33%3A0%2CH34%3A0%2CH187%3A0%2CH188%3A0%2CH120%3A1%2CH59%3A1%2CH88%3A1%2CH98%3A1%2CH141%3A1%2CH45%3A1%2CH46%3A1%2CH100%3A1%2CH79%3A1%2CH132%3A1%2CH119%3A0%2CH12%3A0%2CH123%3A0%2CH4%3A0%2CH102%3A0%2CH76%3A0%2CH103%3A0%2CH82%3A0%2CH60%3A0%2CH96%3A0%2CH167%3A0%2CH20%3A0%2CH22%3A0%2CH97%3A0%2CH139%3A0%2CH121%3A0%2CH65%3A0%2CH110%3A0%2CH111%3A0%2CH112%3A0%2CH185%3A0%2CH114%3A0%2CH190%3A0%2CH153%3A0%2CH144%3A0%2CH106%3A0%2CH140%3A0%2CH165%3A0%2CH169%3A0%2CH145%3A0%2CH31%3A0%2CH116%3A0&genVendors=
.adnxs.com/	1970-01-21 09:53:24	Name: receive-cookie-deprecation Value: 1
.zscaler.com/	1970-01-21 02:27:00	Name: _gcl_au Value: 1.1.1077010013.1729044858
www.zscaler.com/	1970-01-21 09:53:24	Name: _gd_visitor Value: 4672c9e9-9734-49ae-89c0-2d35bc08eaf4
www.zscaler.com/	1970-01-21 00:17:39	Name: _gd_session Value: 359a48ea-eabe-472f-8724-71fcc9532f25
www.zscaler.com/	1970-01-21 00:27:29	Name: _an_uid Value: 0
.doubleclick.net/	1970-01-21 09:53:24	Name: IDE Value: AHWqTUndHqKpkaLtae0J1mawfEheKwHbJPiQ4pB1uB7TiQl27asgZOUwL81x_RFE
.zscaler.com/	1970-01-21 09:53:24	Name: _ga_10SPJ4YJL9 Value: GS1.1.1729044858.1.0.1729044858.60.0.88403871
.zscaler.com/	1970-01-21 02:27:00	Name: _fbp Value: fb.1.1729044858451.5809525985875096
info.zscaler.com/	1969-12-31 23:59:59	Name: BIGipServerabmweb-nginx-app_https Value: !k91nvRVXv0rfrTnagI9xdiUvaZp4gl4ow2K+UlyaGmYBiixdlhIhhmcz2/yY1lneZ1lG3g6kM8dVWg==
.zscaler.com/	1970-01-21 00:18:51	Name: _uetsid Value: 59692b908b6411ef83348d20828f3a93
.zscaler.com/	1970-01-21 09:39:00	Name: _uetvid Value: 596945d08b6411efa7349d7e4f9b8618
.zscaler.com/	1970-01-21 09:53:24	Name: _ga Value: GA1.2.514359380.1729044858
.zscaler.com/	1970-01-21 00:18:51	Name: _gid Value: GA1.2.1171936581.1729044859
.zscaler.com/	1970-01-21 00:17:24	Name: _gat_gtag_UA_6177009_1 Value: 1
.www.zscaler.com/	1970-01-21 09:03:00	Name: _zitok Value: 5d2599fcb7eded6d7e861729044859
.zoominfo.com/	1970-01-21 00:17:26	Name: __cf_bm Value: MaxGASWppo5qeldr_jwuwxGJwOEl0oABoRs0AA71vN0-1729044859-1.0.1.1-0dKAIDSR61GZtr5mFpJYeCIutG1RwSNJIVJLWIiX55iIUoVWtqTRaS8bXDDxyHFohE7bfGipP2.YEqUMC4DNXQ
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: uMsh1jpxhO6StS7xpi9zOQAJhIzL2SOkfqEjnptNFHA-1729044859237-0.0.1.1-604800000

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
worker	verbose	URL: blob:https://www.zscaler.com/04f9a63c-be9b-4314-b955-550e552be8ef(Line 1) Message: Error
security	error	URL: https://js.zi-scripts.com/zi-tag.js Message: Refused to load the script 'blob:https://www.zscaler.com/3d278ea2-17c3-40d4-aff8-b2ff974e5a5a' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscaler.my.site.com/ https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

117186981.intellimizeio.com
306-zej-256.mktoresp.com
acsbapp.com
analytics.google.com
api.intellimize.co
b.6sc.co
bat.bing.com
c.6sc.co
cdn.cookielaw.org
cdn.intellimize.co
connect.facebook.net
eps.6sc.co
geolocation.onetrust.com
googleads.g.doubleclick.net
info.zscaler.com
ipv6.6sc.co
j.6sc.co
js.zi-scripts.com
log.intellimize.co
munchkin.marketo.net
ob.iseaskies.com
obs.iseaskies.com
secure.adnxs.com
stats.g.doubleclick.net
td.doubleclick.net
v.eps.6sc.co
ws-assets.zoominfo.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.zscaler.com
obs.iseaskies.com
www.zscaler.com
104.17.70.206
151.101.2.132
172.217.197.156
172.64.150.44
18.204.24.143
18.67.76.13
192.28.144.124
2001:4860:4802:32::181
23.13.172.203
23.205.106.73
2600:1408:ec00:2e::1735:ba8
2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
2600:9000:250a:7c00:c:d449:2a40:93a1
2606:4700:10::6816:cc
2606:4700:4400::6812:2089
2606:4700::6810:752b
2606:4700::6810:762b
2606:4700::6812:1d4a
2606:4700::6812:572a
2607:f8b0:400d:c03::61
2607:f8b0:400d:c09::8a
2607:f8b0:400d:c0c::63
2607:f8b0:400d:c0d::9d
2607:f8b0:400d:c0f::9a
2607:f8b0:400d:c0f::9d
2620:1ec:33::10
2a03:2880:f003:100:face:b00c:0:3
2a03:2880:f103:181:face:b00c:0:25de
3.216.162.62
35.81.243.85
68.67.179.166
99.83.231.3
02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
093a32c78bbd0d8bfa29c3c98a6343ae00ce1fd759bdf71c8429876633fba23b
09ffe1ebce8835c9b4d8232b59214200e95e6c2d2a3d67aba4d3f578051cd3a8
0b96905923d1c096be22beb729fe7f5e4b7f1ca4e8787c5a412c28986094c28f
0c57780c294c4ac3bb4790f10f11ab4afe4e323819d2ae1278de9cc6b390fc7a
13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5
1ab49fd90ca814517ecccd0199152e764e8fcb16e0fd6ed91358d3aea88f753f
21586cef75b1d6452c110a74f35d5d6d3a271524abdb0cd48572daee4f68a505
21c35ca7dcb88e44359a2bc40e304a728c6d0db54fbf690a3459fb331cd19395
25134b07108d90e56e3cb611cf2629d447a87dcc7bbd2ba6ff6c4d0de9a1b484
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4
2f0ce935f23a1a787a427daf4fd07dd3a394d6ad5b0f4dc74238c76125061f80
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
32002930f50b9bea45f84d40a2a4174520a6ffcbae0df734c015962639c377b3
36abed3d20085dbc2ef2778631d3f5efd0e8000db1925e2de3a18649671d4e02
38ed79d11d70280ff8dae23dae491b49b0f365a99aa9c1b1d05ef03068429abc
395dff1fe3ef19d63bb810df5654c8a71b290f165dca4f7f461bf2ac2367304b
3d8db1e6933ea20fefa725b8f886ee547bf40b730b6f2ab25e917640aaf9f37b
3e6007d6444da0a1f070d77c5c8601eb12f378116c62f7bd19100fd2d536860d
42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c
42c3dfb68ff11fe295d20cdd98826c65161cf5d480d25f72b10d9a182f9e2a1d
460397d5eb09c20821968031b70313c6ca4dcd40c6ee2a65f0f1aec1682d4c43
4e1efebf2f7bd2d57fdd45684a06de77b0141b8f17c6a3d1a3fb8fa48d24e4dc
4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
527832aaf56cb80e17915f827d750c5e5c7bf08fd90a268486edcdf5dc402cb6
53383e308071f119680221c3529389b52db8b9fd233bac6f244c5912c2950598
54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d
58af6a55b4d2c0952761f52771f0f037d7c75dacd825000870666c96c3d61d04
59e58524340cd7ad353be010374b124c242fdde10a0ed41047fe2fd4bb9e5a2e
5bbd9766838bf11e3ff360ec5cbb60d6ada352fbad7f7691e24f847313b9b1d4
5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640
64062b0a850bf476137d3d871000817e2d8f8e8a5461f1918a357348310535b3
6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c
6584ddedd6dd4acfecb27bb596999762a6d336a9aaae8e31ab477e1c9b4bed14
67bada63c3654c7168cedb6be0924d793dc683e81ae6740e3e14f3b181b94ff3
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6dbe68c57ab192827f81a77e6eb981ca8148a82d352a8c47073204feff64bbfd
6e9c619da677845336e5715fd09f8feb00d9ea39c0797c123477725107e3f776
76c645171496c5a2725d98c02c1628dc97fad5696e805bd1714846488c2ec7a3
774e08566a15a9afbb217705a2ca66fa20dc5b34885b6977d428220993147106
7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c
7b6b7b5eae5f0a754d35e48e9e610ba5f0924944dd4461cac77d05f4c5a9368d
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7
7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff
7f2f71c135382ff59ca61fba520b789d9889aa25fd0adca0d3a31182b791569b
7f47f02c93d5de5de03db0ebffa39fe1060767437b086996e295c9818a05b2f2
81526ba2b84901c932e590cf5a995bb42aa4adfcadb51abc11fd1dcd6437c838
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
828fed5bd0375a9f0485a2a756b841c572860e90eb25ef716e49dbc8ec61e691
866d87e06710596a49ecb75a43f613e79874ac106da45115b1586dd5e071a52d
89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140
89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723
8b1a0e0abb57b4f1c00a4a5197e0229c1ec9db6a0d8c12866f3cc47036937098
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
945881686d0a47eee9946902d92626dbfab4570d3c5fab2cb7c6e3343ee01f5c
9582e9526f2849403cbbc760837b703608149a8f003ab2cef5bbb12693b18332
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98fc9c4af2180c95232f81c395a3cee05515c0c16c01f03ce5516200b5c05644
9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd
9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc
aa2b70b04543725807e31004736e56d24f392324656e1559a9a212cbe468f4af
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10
b026ac8e9b650f8a85c8a082f913b04eaa7dde4bf82bef0512f352891b3e0758
b15f5190f031b915809b1896373f463a17135a16282e6b28f24d5a485d919fce
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
b63fbaaedff3fcec4813eb099464737abb62aac29d9f176b3421e3897a9b78b7
b677e677ced8c4a836aed76512f225e795edc1b19123c4cf94a765f8fe89d192
b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc
beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac
c3be590171c0375d497714a608a5c4cd4e90e124e1c0cff1807cd8adb156e64b
c683d7f82f98fd9ac028f600f7cc1693c8ff20cba9f0176d8a3574e8eae2dd69
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cc2754d0558c2e23d1fc81a1e76a0b1febe1afe5eecdc5fadc75f9c33a44f1ed
d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e2c709d3d9a6dade8bb17a7469e0c5a374b804b8bf9939f9d93de19725b371d6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
eddd884436be08bc6ecaff1ea001f0f68eea7fe12664000a6f3646e07961a061
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc5d1f211335a1a7de421ce74c9826b8c93235647ccc6a142715c1a90182108
f5b5463aac4c4d4853bb016bf14743481a63cfe8cff29cc74de6fc2c4f9edc17
f601a9f9aa789f9fbae4bcc96bdaf96b93afe7b7f74ec52dc03f89141cd08c6a
f8b9a51270687afddae089d22440c5231d2876679c608fafe460d4caa2d12c56
f9666d336fc9a09dbc23d8d179db0e470d9c26cd43400498735ede735a455e3b
fa57cc17f597f4002dca2c06225b619ecb9495ee44220d429d4f16d945a3c50f
fa5c21a013b645f008573c41ffaea2cb09df3ec637e75c0d23902e3703d989dc
fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c
fd06da99f01b4d5e3fc4c54e4e3cf4ae18803c08bc113e4cb923638d6e683278
fd8134b4043cb1ce2a1641c56a93561d99bb541ff9820b3c0e115e1b70dd9be3
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.zscaler.com Open in urlscan Pro 2606:4700::6812:1d4a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

139 Requests

95 %HTTPS

59 %IPv6

21 Domains

34 Subdomains

33 IPs

2 Countries

2351 kBTransfer

7502 kBSize

23 Cookies

48 Outgoing links

Redirected requests

139 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.zscaler.com Open in urlscan Pro
2606:4700::6812:1d4a Public Scan

Screenshot
Live screenshot

Full Image

139
Requests

95 %
HTTPS

59 %
IPv6

21
Domains

34
Subdomains

33
IPs

2
Countries

2351 kB
Transfer

7502 kB
Size

23
Cookies

139 HTTP transactions
0 data transactions