www.zscaler.com Open in urlscan Pro
2606:4700:4400::6812:2215 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Submission: On December 14 via api (December 14th 2024, 11:14:26 am UTC) from IN — Scanned from CA

Summary HTTP 153 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 32 IPs in 2 countries across 21 domains to perform 153 HTTP transactions. The main IP is 2606:4700:4400::6812:2215, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com. The Cisco Umbrella rank of the primary domain is 68501.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 28th 2024. Valid for: a year.

This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
57	2606:4700:440... 2606:4700:4400::6812:2215	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.17.72.206 104.17.72.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2607:f8b0:400... 2607:f8b0:4004:c06::61	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.13.172.203 23.13.172.203	16625 (AKAMAI-AS) (AKAMAI-AS)
14	23.205.106.73 23.205.106.73	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2600:9000:250... 2600:9000:250a:9a00:c:d449:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2600:1f18:e8a... 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a	14618 (AMAZON-AES) (AMAZON-AES)
1	68.67.160.26 68.67.160.26	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:1408:c40... 2600:1408:c400:d::17cd:6a49	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	172.253.122.155 172.253.122.155	15169 (GOOGLE) (GOOGLE)
2 3	2607:f8b0:400... 2607:f8b0:4004:c1b::9c	15169 (GOOGLE) (GOOGLE)
2 4	2607:f8b0:400... 2607:f8b0:4004:c1d::93	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:400d:c02::5e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:38::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c04::9d	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4004:c0b::9d	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:400d:c00::64	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	3.171.76.19 3.171.76.19	16509 (AMAZON-02) (AMAZON-02)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.66.132 151.101.66.132	54113 (FASTLY) (FASTLY)
1	3.227.183.172 3.227.183.172	14618 (AMAZON-AES) (AMAZON-AES)
2	52.0.148.147 52.0.148.147	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6810:762b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:752b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	52.89.27.251 52.89.27.251	16509 (AMAZON-02) (AMAZON-02)
153	32

57 2606:4700:4400::6812:2215 (United States)

ASN13335 (CLOUDFLARENET, US)

www.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.zscaler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4004:c06::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.13.172.203 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-13-172-203.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 23.205.106.73 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-205-106-73.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:250a:9a00:c:d449:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

ob.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

obs.iseaskies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.160.26 (Colonia, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:d::17cd:6a49 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.122.155 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bh-in-f155.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c1b::9c (Washington, United States) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c1d::93 (Washington, United States) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c02::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:38::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c04::9d (Morganton, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c0b::9d (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c00::64 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.171.76.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-171-76-19.iad89.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.227.183.172 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-183-172.compute-1.amazonaws.com

117186981.intellimizeio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.0.148.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-148-147.compute-1.amazonaws.com

api.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:762b (United States)

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:752b (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.89.27.251 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-89-27-251.us-west-2.compute.amazonaws.com

log.intellimize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	zscaler.com www.zscaler.com — Cisco Umbrella Rank: 68501 info.zscaler.com — Cisco Umbrella Rank: 680312 cms.zscaler.com	2 MB
19	6sc.co j.6sc.co — Cisco Umbrella Rank: 5557 c.6sc.co — Cisco Umbrella Rank: 6739 ipv6.6sc.co — Cisco Umbrella Rank: 5633 eps.6sc.co — Cisco Umbrella Rank: 9024 b.6sc.co — Cisco Umbrella Rank: 3603 v.eps.6sc.co — Cisco Umbrella Rank: 16220	25 KB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 329	199 KB
7	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 stats.g.doubleclick.net — Cisco Umbrella Rank: 135 td.doubleclick.net — Cisco Umbrella Rank: 182	3 KB
7	iseaskies.com ob.iseaskies.com — Cisco Umbrella Rank: 581120 obs.iseaskies.com — Cisco Umbrella Rank: 410514	40 KB
6	intellimize.co cdn.intellimize.co — Cisco Umbrella Rank: 46431 api.intellimize.co — Cisco Umbrella Rank: 39078 log.intellimize.co — Cisco Umbrella Rank: 37598	111 KB
5	zoominfo.com ws-assets.zoominfo.com — Cisco Umbrella Rank: 11137 ws.zoominfo.com — Cisco Umbrella Rank: 4514	17 KB
5	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 142	112 B
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	587 KB
4	google.ca www.google.ca — Cisco Umbrella Rank: 11557	255 B
4	bing.com bat.bing.com — Cisco Umbrella Rank: 359	16 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5643	4 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	212 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
2	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 96	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	77 KB
1	intellimizeio.com 117186981.intellimizeio.com
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 495	702 B
1	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3671	1 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 514	306 B
0	acsbapp.com Failed acsbapp.com Failed
153	21

	Domain	Requested by
55	www.zscaler.com	www.zscaler.com
11	b.6sc.co	www.zscaler.com
11	cdn.cookielaw.org	www.zscaler.com cdn.cookielaw.org
7	info.zscaler.com	www.zscaler.com info.zscaler.com
6	obs.iseaskies.com	ob.iseaskies.com www.zscaler.com
5	www.googletagmanager.com	www.zscaler.com ob.iseaskies.com www.googletagmanager.com
4	ws.zoominfo.com	js.zi-scripts.com ws-assets.zoominfo.com
4	www.google.ca	www.zscaler.com
4	www.google.com	2 redirects www.googletagmanager.com www.zscaler.com
4	bat.bing.com	ob.iseaskies.com bat.bing.com www.zscaler.com
3	log.intellimize.co	cdn.intellimize.co
3	js.zi-scripts.com	www.zscaler.com js.zi-scripts.com
3	td.doubleclick.net	www.googletagmanager.com
3	googleads.g.doubleclick.net	2 redirects www.googletagmanager.com
2	api.intellimize.co	cdn.intellimize.co
2	v.eps.6sc.co	j.6sc.co
2	www.facebook.com	www.zscaler.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.googleadservices.com	1 redirects www.googletagmanager.com
2	connect.facebook.net	ob.iseaskies.com connect.facebook.net
2	eps.6sc.co	j.6sc.co
2	j.6sc.co	www.zscaler.com j.6sc.co
2	cms.zscaler.com	www.zscaler.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	117186981.intellimizeio.com	cdn.intellimize.co
1	cdn.intellimize.co	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	ob.iseaskies.com	www.zscaler.com
1	munchkin.marketo.net	www.zscaler.com
1	geolocation.onetrust.com	cdn.cookielaw.org
0	acsbapp.com Failed	www.zscaler.com
153	35

This site contains links to these domains. Also see Links.

Domain
threatlabz.zscaler.com
help.zscaler.com
admin.zscaler.net
admin.zscalerone.net
admin.zscalertwo.net
admin.zscalerthree.net
admin.zscalerbeta.net
admin.zscloud.net
admin.private.zscaler.com
admin.zpatwo.net
partners.zscaler.com
securitypreview.zscaler.com
customer.zscaler.com
community.zscaler.com
ir.zscaler.com
www.facebook.com
x.com
www.linkedin.com
medium.com
www.cisa.gov
www.rapid7.com
threatlibrary.zscaler.com
www.youtube.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
www.zscaler.com DigiCert SHA2 Extended Validation Server CA	`2024-02-28` - `2025-02-23`	a year	crt.sh
cookielaw.org WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
info.zscaler.com WE1	`2024-11-05` - `2025-02-03`	3 months	crt.sh
*.google-analytics.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-22` - `2025-10-24`	a year	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.iseaskies.com Amazon RSA 2048 M02	`2024-06-18` - `2025-07-18`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-09-23` - `2024-12-22`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.doubleclick.net WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.google.ca WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.googleadservices.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
zi-scripts.com WE1	`2024-11-20` - `2025-02-18`	3 months	crt.sh
cdn.intellimize.co R10	`2024-11-10` - `2025-02-08`	3 months	crt.sh
*.intellimizeio.com Amazon RSA 2048 M03	`2024-09-24` - `2025-10-22`	a year	crt.sh
api.intellimize.co Amazon RSA 2048 M03	`2024-09-24` - `2025-10-22`	a year	crt.sh
zoominfo.com E5	`2024-12-10` - `2025-03-10`	3 months	crt.sh
log.intellimize.co Amazon RSA 2048 M03	`2024-09-23` - `2025-10-22`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Frame ID: A71F8CF5079F505EE5B5103F5AF5A108
Requests: 140 HTTP requests in this frame

Frame: https://info.zscaler.com/index.php/form/XDFrame
Frame ID: F42534243B9F45BE1253F116AAA2B59E
Requests: 2 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-10SPJ4YJL9&gacid=1242532801.1734174858&gtm=45je4cc1v883639532za200zb71607006&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1940401399
Frame ID: EE7FD91854E919B753655872A8AA0ECE
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/812494211?random=1734174857658&cv=11&fst=1734174857658&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: 5ED235FCF21DF58EDBF817D69593DACD
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/812494211?random=1734174857728&cv=11&fst=1734174857728&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0
Frame ID: 28B81A2C1F155B9054BF150117656184
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: D7CB101667D8C9E026F0FBAAEDBE50D2
Requests: 2 HTTP requests in this frame

Frame: https://117186981.intellimizeio.com/storage.html
Frame ID: A23E7D21873E225C421DA18D5D1D46A5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Technical Analysis of Zloader 2.9.0.4 | ThreatLabz

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

153
Requests

95 %
HTTPS

61 %
IPv6

21
Domains

35
Subdomains

32
IPs

2
Countries

2784 kB
Transfer

7456 kB
Size

24
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://threatlabz.zscaler.com/
Title: ThreatLabz

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/phone-support
Title: Support

Search URL Search Domain Scan URL

URL: https://admin.zscaler.net/
Title: Zscaler Cloud Portal | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerone.net/
Title: Zscaler Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalertwo.net/
Title: Zscaler Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerthree.net/
Title: Zscaler Cloud Portal Three | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscalerbeta.net/
Title: Zscaler Cloud Portal Beta | Admin

Search URL Search Domain Scan URL

URL: https://admin.zscloud.net/
Title: admin.zscloud.net

Search URL Search Domain Scan URL

URL: https://admin.private.zscaler.com/
Title: Zscaler Private Access Cloud Portal One | Admin

Search URL Search Domain Scan URL

URL: https://admin.zpatwo.net/
Title: Zscaler Private Access Cloud Portal Two | Admin

Search URL Search Domain Scan URL

URL: https://partners.zscaler.com/s/partneronboarding
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://threatlabz.zscaler.com/cloud-insights/cloud-activity-dashboard
Title: ThreatLabz Analytics

Search URL Search Domain Scan URL

URL: http://securitypreview.zscaler.com/
Title: Security Preview

Search URL Search Domain Scan URL

URL: https://customer.zscaler.com/
Title: Customer Success Center

Search URL Search Domain Scan URL

URL: https://community.zscaler.com/
Title: Zenith Community

Search URL Search Domain Scan URL

URL: https://help.zscaler.com/
Title: Zscaler Help Portal

Search URL Search Domain Scan URL

URL: https://ir.zscaler.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://tinyurl.com/2y7jxsyk

Search URL Search Domain Scan URL

URL: https://x.com/intent/tweet?text=https://tinyurl.com/2y7jxsyk%20%E2%80%94%20Inside%20Zloader%E2%80%99s%20Latest%20Trick%3A%20DNS%20Tunneling%22

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://tinyurl.com/2y7jxsyk

Search URL Search Domain Scan URL

URL: https://medium.com/walmartglobaltech/unknown-powershell-backdoor-with-ties-to-new-zloader-88ca51d38850
Title: Open source reporting

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a
Title: CISA

Search URL Search Domain Scan URL

URL: https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/
Title: Rapid7

Search URL Search Domain Scan URL

URL: https://threatlibrary.zscaler.com/threats/685e24cf-046e-412f-96cd-6031f9e7fcde
Title: Win64.Downloader.Zloader

Search URL Search Domain Scan URL

URL: https://www.facebook.com/zscaler
Title: Visit us on Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zscaler
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://x.com/zscaler
Title: Follow us on X

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/ZscalerMarketing
Title: Subscribe our Youtube Channel

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 91

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIhsv64pCnigMVQgiICR3ccQXCMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8 HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIhsv64pCnigMVQgiICR3ccQXCMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dUfUxsIFEAAawkwvZZFcM0gznUBks6Q&random=518752184 HTTP 302
https://www.google.ca/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIhsv64pCnigMVQgiICR3ccQXCMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dUfUxsIFEAAawkwvZZFcM0gznUBks6Q&random=518752184&ipr=y

Request Chain 112

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIvKWA45CnigMVTA2ICR3Lty5KMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU1YkR4NlBHa2pfN1A4Qk5lbHNRbTJtempQemRBLVlyNVhjeUhqbEhrM19TVWxoR2xWWFNRYw HTTP 302
https://www.google.com/pagead/1p-conversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIvKWA45CnigMVTA2ICR3Lty5KMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU1YkR4NlBHa2pfN1A4Qk5lbHNRbTJtempQemRBLVlyNVhjeUhqbEhrM19TVWxoR2xWWFNRYw&is_vtc=1&cid=CAQSGwCa7L7d4Fu0f7BGOOBqIzWWuWDd3P-XmtGC_Q&random=1610180324 HTTP 302
https://www.google.ca/pagead/1p-conversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIvKWA45CnigMVTA2ICR3Lty5KMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU1YkR4NlBHa2pfN1A4Qk5lbHNRbTJtempQemRBLVlyNVhjeUhqbEhrM19TVWxoR2xWWFNRYw&is_vtc=1&cid=CAQSGwCa7L7d4Fu0f7BGOOBqIzWWuWDd3P-XmtGC_Q&random=1610180324&ipr=y

153 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request inside-zloader-s-latest-trick-dns-tunneling Show response
www.zscaler.com/blogs/security-research/ 432 KB
75 KB 383ms
202ms Document
text/html 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

5c4f9af20d0e9e67c30c40d4fbb8f90ca63c28d56c68586906441b63095f0071

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 500
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
cf-cache-status: DYNAMIC
cf-ray: 8f1dc4ee3e567c8d-EWR
content-encoding: br
content-security-policy: default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://*.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com *.mountain.com https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://*.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://*.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://*.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://*.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://*.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:15 GMT
netlify-vary: query=__nextDataReq,header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data
server: cloudflare
strict-transport-security: max-age=31536000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN https://cms.zscaler.com
x-nextjs-date: Sat, 14 Dec 2024 11:14:14 GMT
x-nf-request-id: 01JF2E0M8T7SNN8C5281JKJPJ1
x-powered-by: Next.js
x-xss-protection: 1; mode=block

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 260ms
106ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50d93a2c186cbd1032ed973e133713a6dfbbd5f7fba4fb89069350f228ce4d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: UzmBk0Ra4K9he+CwjGKb/g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD1BF06242194D
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 11893
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/javascript
last-modified: Sat, 14 Dec 2024 03:35:41 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8f37caf0-301e-00c3-53d9-4d1ac9000000
cf-ray: 8f1dc4f09f917c9a-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7211
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 468 KB
469 KB 174ms
169ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fremote_work%2520copy.jpeg&w=3840&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

761ffedd43b89b04bb84218b0a118a9719765dd3a058841973f2a071a64730b6

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 4623
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf367c8d-EWR
netlify-vary: query=fit|format|w|height|crop|quality|url|fm|width|h|position|q|timestamp
content-length: 479116
x-nf-request-id: 01JF2E0MGQP4VVS7ZW40NF040F
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ 199 KB
67 KB 299ms
97ms Script
application/x-javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "303ea2-31b73-6265f10fde9e8"
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f0de73ac0f-YYZ
expires: Sat, 14 Dec 2024 15:14:15 GMT
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/x-javascript
last-modified: Fri, 08 Nov 2024 04:20:09 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 219e54771de95554-s.p.woff2
www.zscaler.com/_next/static/media/ 37 KB
37 KB 110ms
105ms Font
font/woff2 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/219e54771de95554-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "ee94ab2a11412903ad9756e2edb68d05-ssl"
age: 27911
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf2d7c8d-EWR
accept-ranges: bytes
content-length: 37876
x-nf-request-id: 01JF2E0MFC3Z1NRKPJ2KSFYE0C
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 86085b213eb89904-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
39 KB 157ms
152ms Font
font/woff2 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/86085b213eb89904-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "9430f4d344e4fa79ef6a839ba362694c-ssl"
age: 27995
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf2e7c8d-EWR
accept-ranges: bytes
content-length: 40264
x-nf-request-id: 01JF2E0MGKX1H9Z7DT2HTBPZVB
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 9cdafb0650413334-s.p.woff2
www.zscaler.com/_next/static/media/ 39 KB
40 KB 156ms
151ms Font
font/woff2 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/9cdafb0650413334-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "aa81c4751d270062c6783d25c81b8021-ssl"
age: 31980
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf2f7c8d-EWR
accept-ranges: bytes
content-length: 40336
x-nf-request-id: 01JF2E0MGK72SXB953V1187QH0
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 4012cc4b67ad157d-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
10 KB 107ms
103ms Font
font/woff2 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/4012cc4b67ad157d-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "93ae142d2bfd17c936f3d91401658758-ssl"
age: 18437
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf307c8d-EWR
accept-ranges: bytes
content-length: 9592
x-nf-request-id: 01JF2E0MF9DGRTP6MARVYW202Q
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 41998fdc1b8220a0-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
10 KB 135ms
131ms Font
font/woff2 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/41998fdc1b8220a0-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "672d4a5030823e96757755c555bf2027-ssl"
age: 32995
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf317c8d-EWR
accept-ranges: bytes
content-length: 9620
x-nf-request-id: 01JF2E0MFZTYWSPR5BBEAJZ0WF
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 edb9f1eb1c1a7ead-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 111ms
108ms Font
font/woff2 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/edb9f1eb1c1a7ead-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "e32ff74f0d5d916b5dda832b01fd5fc8-ssl"
age: 32785
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf337c8d-EWR
accept-ranges: bytes
content-length: 8780
x-nf-request-id: 01JF2E0MFDGCXH97RE3EJGSQ58
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 ce9b84dce7581e2b-s.p.woff2
www.zscaler.com/_next/static/media/ 9 KB
9 KB 113ms
109ms Font
font/woff2 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/media/ce9b84dce7581e2b-s.p.woff2

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.zscaler.com
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
etag: "067a5289e0e684ba833d5d7b2beb3f51-ssl"
age: 32403
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf347c8d-EWR
accept-ranges: bytes
content-length: 8764
x-nf-request-id: 01JF2E0MFG40S87QSF6HYA20QA
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: font/woff2
server: cloudflare

GET
H2 200 ec0ab51eef94ed27.css
www.zscaler.com/_next/static/css/ 119 KB
23 KB 83ms
80ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/ec0ab51eef94ed27.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7d91a422c4e10532fdffafa9d64a11dbbfdd0943736eb7cfff5652fa3921b56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"13628a7b1f9d77ec7ee16eb9321f7903-ssl-df"
age: 14845
x-content-type-options: nosniff
cf-ray: 8f1dc4ef9f1f7c8d-EWR
x-nf-request-id: 01JF2E0MEF5RM687NKET11K9C7
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 3af0ea8ee1d54b3f.css
www.zscaler.com/_next/static/css/ 80 KB
11 KB 107ms
104ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/3af0ea8ee1d54b3f.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7a807c808a7b103144313c0e6c26f870-ssl-df"
age: 23703
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf257c8d-EWR
x-nf-request-id: 01JF2E0MFAKAZE764K2C8HKCP6
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 60ab7ffa9f7999ec.css
www.zscaler.com/_next/static/css/ 849 B
385 B 133ms
130ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/60ab7ffa9f7999ec.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4fd28ce5d07640308fd628361ee9dd2e-ssl"
age: 27274
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf267c8d-EWR
x-nf-request-id: 01JF2E0MFX0Q8CK6RT6HD7PR2V
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
server: cloudflare

GET
H2 200 54b114f76a2643a4.css
www.zscaler.com/_next/static/css/ 14 KB
2 KB 157ms
155ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/54b114f76a2643a4.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"9b8c484af22ed99c9052a8a53f1fb90c-ssl-df"
age: 14575
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf277c8d-EWR
x-nf-request-id: 01JF2E0MGM64C0EQ8J91K488Y0
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5d77889da123159b.css
www.zscaler.com/_next/static/css/ 12 KB
2 KB 110ms
107ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/5d77889da123159b.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

939dd94ce46c2fc3503254f604250f1874490f419d4e67c6ceee53a2f16cf64f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"fcfc33de0559aa249beb860c95544f28-ssl-df"
age: 32933
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf287c8d-EWR
x-nf-request-id: 01JF2E0MFCW6AGRQJ8DKZKQY7M
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 4114629b6bc6d7fb.css
www.zscaler.com/_next/static/css/ 5 KB
913 B 124ms
122ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/4114629b6bc6d7fb.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

946afb146fc270d96525d1c7470e1351af1551f9fe87637cc65ea9f2d0246d37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"dd721fa923a83a8785c4556847930301-ssl-df"
age: 27095
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf297c8d-EWR
x-nf-request-id: 01JF2E0MFG9HC6TGW5J6XG7ARV
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 455227249223c84c.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 103ms
101ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/455227249223c84c.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"c7271019cbe209844cca8826be137418-ssl-df"
age: 26810
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf2a7c8d-EWR
x-nf-request-id: 01JF2E0MEW5ZYH96GSHA7GHMJ7
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 cbb48fb32911860a.css
www.zscaler.com/_next/static/css/ 19 KB
3 KB 103ms
102ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/cbb48fb32911860a.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

477029b64ea9a0f457b44c1d514c816624370cbddfaff93a2b90e36a52a5974e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"54b05a3a81ec164172cba82a707edd60-ssl-df"
age: 29688
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf2b7c8d-EWR
x-nf-request-id: 01JF2E0MF8RRC762HXN17JCJC2
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 d34fc117d4462dbb.css
www.zscaler.com/_next/static/css/ 7 KB
1 KB 133ms
131ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/d34fc117d4462dbb.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a2957e3f52eaaa2164c4c260e8a99bde-ssl-df"
age: 27274
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf2c7c8d-EWR
x-nf-request-id: 01JF2E0MFXZWCSBTC0XN0V5W69
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 79723601f4599fef.css
www.zscaler.com/_next/static/css/ 25 KB
4 KB 123ms
122ms Stylesheet
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/79723601f4599fef.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7314898ae5841be613f65db4ba6b81d17e8a1e2a28cf11c40c0dbfcaa0a9859a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"1f3b977d0905b75df1322c5ebdb23b2d-ssl-df"
age: 29460
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf377c8d-EWR
x-nf-request-id: 01JF2E0MFKQ6VJMGJM8K25TQ9X
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1664.9b8ca4ecc35d08d1.js Show response
www.zscaler.com/_next/static/chunks/ 7 KB
3 KB 138ms
133ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1664.9b8ca4ecc35d08d1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1580616e3616a775919fdab1a24b8c5d33dfa8f0e2c4265c0ab192a5bc59c6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"efb7e61c18a537d82656b6e0dd119fbd-ssl-df"
age: 31740
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf397c8d-EWR
x-nf-request-id: 01JF2E0MG9H3JCG54J63FE4V77
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 4974.ad930a913a695af6.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 119ms
114ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/4974.ad930a913a695af6.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb7aab905facf6c6fceee3cedfae6d685ec490a50103422a2726f92e117429e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"2df9ad71ed4694bb833c1f269b015429-ssl-df"
age: 25482
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf3a7c8d-EWR
x-nf-request-id: 01JF2E0MFKJ5PKTFV0XCJTGRWG
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 9955.16e6f491dc3d3e16.js Show response
www.zscaler.com/_next/static/chunks/ 8 KB
3 KB 117ms
112ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9955.16e6f491dc3d3e16.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8228a5e160e09389114752fef88589847b2a2925c2ad447a2a0d1346a154feea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"4b29d5b2672ed34edb353d2997a1f1d7-ssl-df"
age: 17013
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf3c7c8d-EWR
x-nf-request-id: 01JF2E0MFHNCBSM5PZ0B6BPHGF
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1151.0f7ca30a25f2c8e3.js Show response
www.zscaler.com/_next/static/chunks/ 605 B
464 B 104ms
100ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1151.0f7ca30a25f2c8e3.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

997fddba8851c6cdf1a13ee986e9ffa6b750afc46ee4809b2642d1f70a496706

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"cd53f1d74d232601f2dfaffc8b12f256-ssl"
age: 34012
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf3d7c8d-EWR
x-nf-request-id: 01JF2E0MFD2NBTBFXQ0WBM963Z
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 9017.74505813881349e1.js Show response
www.zscaler.com/_next/static/chunks/ 115 KB
37 KB 131ms
126ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9017.74505813881349e1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b87b2d30bb74bfe1d30f849caa9318b5c9f2df4216324c4c91e5c301284a50e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a83096a536225490fad1253c28b4bca6-ssl-df"
age: 33243
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf3e7c8d-EWR
x-nf-request-id: 01JF2E0MG40YTTWP03CZGJT9QJ
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1732.5012f37f5ab7b0c8.js Show response
www.zscaler.com/_next/static/chunks/ 4 KB
2 KB 131ms
127ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/1732.5012f37f5ab7b0c8.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e95b3816c967bdd21a6fd5b39e1a0d4190558ea29c3fc301df3cd049ee5b3a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"183e1fe66b759c6ab8b4e8f5215d8b57-ssl-df"
age: 27274
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf3f7c8d-EWR
x-nf-request-id: 01JF2E0MG5KMPGQPB951XTWFY3
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 7526.2a7c0172ebdd27ea.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
1 KB 121ms
117ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7526.2a7c0172ebdd27ea.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55bb56299447bf3276bebf85f43c48b77d0e3bfdfbb6e4b278140d2ce971861

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"baa0680f097c1caa266889b2586630f0-ssl-df"
age: 28482
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf407c8d-EWR
x-nf-request-id: 01JF2E0MFPAG4VDXCTD2Q15HVC
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 9328.ffe81042b943e268.js Show response
www.zscaler.com/_next/static/chunks/ 7 KB
3 KB 116ms
112ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/9328.ffe81042b943e268.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5aaf7b9640925e4c588a8aa3a603f77889102f1b367db3becd44acbc5fe3ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"8e4e91507e70f9fcd3d09fdd2fb16046-ssl-df"
age: 27274
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf417c8d-EWR
x-nf-request-id: 01JF2E0MFHHEN351G8KAX89KB9
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 938.dd59828e1962ef9a.js Show response
www.zscaler.com/_next/static/chunks/ 3 KB
2 KB 167ms
163ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/938.dd59828e1962ef9a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c35f6dd3b0ba20509d10536d6ecb201aa8e4ec53720402c566210f6fc5119770

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"a96638234cca20ac23e68f5847269f66-ssl-df"
age: 19151
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf427c8d-EWR
x-nf-request-id: 01JF2E0MGWN3M73DAY8ZW2XQPC
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2120.1d0c960f2160de87.js Show response
www.zscaler.com/_next/static/chunks/ 43 KB
14 KB 157ms
153ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2120.1d0c960f2160de87.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92cad8f27e34bc081537b645a016152ce14c43f4d06870641fc63a34ed398445

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"0e06bf3da788e9863899b11097221a84-ssl-df"
age: 21321
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf437c8d-EWR
x-nf-request-id: 01JF2E0MGSFYJ5VSWTQC922SNJ
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 webpack-b78d7c3aa49f6203.js Show response
www.zscaler.com/_next/static/chunks/ 12 KB
6 KB 119ms
116ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd56cd9bfe6aeb270cbe6ba7f18e2e7d10101c34faca85d0eeda54fd37fcde24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"49dc37b53be78b64a042453cab84a86d-ssl-df"
age: 27487
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf447c8d-EWR
x-nf-request-id: 01JF2E0MFMT5ENM60WQBGRF5ZS
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 framework-a71af9b1c76f668e.js Show response
www.zscaler.com/_next/static/chunks/ 137 KB
45 KB 202ms
199ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/framework-a71af9b1c76f668e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95574fc190611a6573178d07fb4e40ff98d224fb735648d76faafa20ae6dfbf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"22e6ceed8b1f05efe6213626eb3b2956-ssl-df"
age: 29194
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf457c8d-EWR
x-nf-request-id: 01JF2E0MH4DN3MH5Y40XARFENM
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main-8dadffc346739bd9.js Show response
www.zscaler.com/_next/static/chunks/ 111 KB
33 KB 135ms
132ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f0b15a1afaad3090fcd15f3b85c16f3cd72b58498d099ceda1500749ba0e611

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"f70bb75530f65ad946ebe64c4c5c7271-ssl-df"
age: 38470
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf467c8d-EWR
x-nf-request-id: 01JF2E0MG99MN07NNPHDHHHE6D
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _app-2ac8f4988fa93ff1.js Show response
www.zscaler.com/_next/static/chunks/pages/ 421 KB
136 KB 136ms
134ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/_app-2ac8f4988fa93ff1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

345877cdead5971b6dedd246401b2e833e02436e6abc4a254c8531b6cde639cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"ca1f5f3c38901e1c034f7957a3db7fc7-ssl-df"
age: 23086
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf477c8d-EWR
x-nf-request-id: 01JF2E0MGARX2608Y6VQAVFXQ7
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2635-846f40232fe95cc5.js Show response
www.zscaler.com/_next/static/chunks/ 207 KB
56 KB 249ms
246ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2635-846f40232fe95cc5.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ebb64cfb1007ee817bc11299a7a829dfe574d6a1ae4389056b23fbb7d0e1863

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"5e02bd735da1b9b792d5f676af7dcab0-ssl-df"
age: 23324
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf487c8d-EWR
x-nf-request-id: 01JF2E0MGW8E31FN6K177H89WH
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 3137-eef5947276778551.js Show response
www.zscaler.com/_next/static/chunks/ 136 KB
38 KB 134ms
131ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/3137-eef5947276778551.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f34dcf4b0199f8e65fb814e549773b31ac54998d949e166432362f35e5cf4ece

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"afbdd3d4922908132dbe45ee55655638-ssl-df"
age: 25590
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf4a7c8d-EWR
x-nf-request-id: 01JF2E0MG682TPA0VFH0DX3ZV8
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 7214-5d486d4dcf3ed718.js Show response
www.zscaler.com/_next/static/chunks/ 62 KB
18 KB 137ms
135ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7214-5d486d4dcf3ed718.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

543903cf053c0b027960d51a539f5e0e4b9597de2b7b80c79156d2ee78f5fe7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"ed7d326483aff66b538a9c181d147f2f-ssl-df"
age: 14701
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf4b7c8d-EWR
x-nf-request-id: 01JF2E0MGBW0SM0DNTM1A82VRV
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 2394-4eda273cccb298fb.js Show response
www.zscaler.com/_next/static/chunks/ 141 KB
32 KB 119ms
117ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/2394-4eda273cccb298fb.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

754a58487a0b52ac215f05028c3aebf5c50d4340c4f56686fa27e24a8a4382fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"f9ea061fca16793d7be5ec4b346e9230-ssl-df"
age: 2840
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf4c7c8d-EWR
x-nf-request-id: 01JF2E0MFSW2JTM6WSVK80R5M7
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 %5B...slug%5D-27d771f84ba00ca1.js Show response
www.zscaler.com/_next/static/chunks/pages/blogs/ 3 KB
1 KB 121ms
119ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/pages/blogs/%5B...slug%5D-27d771f84ba00ca1.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c417149b38800590986d283c74fe63b0f47f102c0f31fae6156f7b8e1b1d1d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"1bf2cd4171a2feda477cbe7905a77afb-ssl-df"
age: 27816
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf4e7c8d-EWR
x-nf-request-id: 01JF2E0MFTZW9M7J1RVG1BM252
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _buildManifest.js Show response
www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/ 3 KB
1 KB 164ms
162ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/_buildManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a59c1831b74b091c96a1938665c946f4a18a1294cc87867042d7ff5eebc34c79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"b152c1130f16d5c22434039ecd961dcd-ssl-df"
age: 27852
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf4f7c8d-EWR
x-nf-request-id: 01JF2E0MGWJHJ1HV58TCNGC52M
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 _ssgManifest.js Show response
www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/ 449 B
324 B 132ms
130ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/q3ZzCc1ezD5e2ACNtK8_c/_ssgManifest.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"d483bd250a3ef832dcda9d330b187d08-ssl"
age: 30033
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf527c8d-EWR
x-nf-request-id: 01JF2E0MG7CKTYM2Z4HDTEDT9D
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 email-decode.min.js Show response
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
818 B 70ms
70ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"675318bd-4d7"
x-content-type-options: nosniff
cf-ray: 8f1dc4efaf547c8d-EWR
expires: Mon, 16 Dec 2024 11:14:15 GMT
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/javascript
last-modified: Fri, 06 Dec 2024 15:31:09 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: DENY

GET
H2 200 image
www.zscaler.com/_next/ 2 KB
2 KB 102ms
100ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FGartner-report.png&w=256&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f79f5f093b0603e16eb2ca2ac669545bba5eb6ed1155337799dbe1e203f6e27f

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 28481
x-content-type-options: nosniff
cf-ray: 8f1dc4f178527c8d-EWR
netlify-vary: query=height|position|url|fit|w|h|crop|q|quality|timestamp|fm|format|width
content-length: 2392
x-nf-request-id: 01JF2E0MQPB5YWVWGNS73SYEYM
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 8 KB
8 KB 103ms
101ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fsub-menu%2FCxo-revolutionaries.png&w=384&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14135d774836383854e7b6bbe9405f82e33786fb0a4663970efaffbc7a59d33d

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 29609
x-content-type-options: nosniff
cf-ray: 8f1dc4f178537c8d-EWR
netlify-vary: query=fm|w|h|height|q|quality|timestamp|url|fit|format|width|position|crop
content-length: 7752
x-nf-request-id: 01JF2E0MQN26DFNFGEK51GXJXB
date: Sat, 14 Dec 2024 11:14:15 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 911 B
1 KB 208ms
206ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=%2Fassets%2Fimages%2Fdefault-avatar.png&w=96&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6315be78209cf808f242f765734bbd6c8dbc95b83285fe2bd2978311699d4ff

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 2
x-content-type-options: nosniff
cf-ray: 8f1dc4f1c87a7c8d-EWR
netlify-vary: query=width|height|crop|timestamp|url|format|w|h|position|q|quality|fit|fm
content-length: 911
x-nf-request-id: 01JF2E0MS4ZMQMBY6D27RBYRH9
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 attack_chain.png
cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/ 25 KB
25 KB 134ms
132ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/attack_chain.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a6b5937200edcb2aad4b81983c3fed49bf9ea80312843bb51435defabeba435

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-cache-status: HIT
etag: "cfDvqSS8RuUIXtTdPBsMhJxajU1gWqs-rDoNB_ezzVDw"
cf-bgj: imgq:85,h2pri
cf-resized: internal=ok/h q=0 n=16+128 c=0+0 v=2024.12.1 l=25296 f=false
warning: cf-images 299 "cache-control is too restrictive"
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: image/avif
last-modified: Thu, 05 Dec 2024 15:28:16 GMT
vary: Accept, Accept-Encoding
strict-transport-security: max-age=31536000; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=300
via: varnish
cf-ray: 8f1dc4f1c87c7c8d-EWR
accept-ranges: bytes
content-length: 25296
server: cloudflare

GET
H2 200 highlighted_example_0.png
cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/ 25 KB
25 KB 126ms
125ms Image
image/webp 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.zscaler.com/cdn-cgi/image/format=auto/sites/default/files/images/blogs/highlighted_example_0.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca85d182af9fb895f4c9ac79ed8fdaf091eb3e1bca127ed880ae4ba5d82b60ab

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-cache-status: HIT
etag: "cfVq-0bvmWajWmc_rin24kUbhD1gWqs-rDoNB_ezzVDw"
cf-bgj: imgq:100,h2pri
cf-resized: internal=ok/h q=0 n=19+246 c=0+0 v=2024.10.6 l=25560 f=false
warning: cf-images 299 "cache-control is too restrictive", cf-images 299 "image too large for AVIF"
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: image/webp
last-modified: Wed, 04 Dec 2024 22:38:27 GMT
vary: Accept, Accept-Encoding
strict-transport-security: max-age=31536000; preload
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=300
via: varnish
cf-ray: 8f1dc4f1c87b7c8d-EWR
accept-ranges: bytes
content-length: 25560
server: cloudflare

GET
H2 200 3e894970-e3e9-4783-85e9-7c38eedbfbbf.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/ 6 KB
2 KB 315ms
84ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/3e894970-e3e9-4783-85e9-7c38eedbfbbf.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c96efc8ef4ae42bb64446649003f53e7bc981a095f07c6ec3807cfcb47039575

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: mWjxWELvqMF6E6na1w5L5g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD1608192F02C6
age: 71309
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sun, 15 Dec 2024 11:14:16 GMT
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Fri, 06 Dec 2024 15:10:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 3a46fb5d-001e-0103-15f0-47d6d8000000
cf-ray: 8f1dc4f31bddefa7-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1862
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 7763.d758ee891eda7402.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
746 B 85ms
84ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/7763.d758ee891eda7402.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"0500e040eba5ed9e5d82333085bd8bd7-ssl-df"
age: 34238
x-content-type-options: nosniff
cf-ray: 8f1dc4f1f8a67c8d-EWR
x-nf-request-id: 01JF2E0MT8HFNQZKQPWYPDZ6XV
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5551.c4fb596d5a66633e.js Show response
www.zscaler.com/_next/static/chunks/ 1000 B
711 B 84ms
83ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/5551.c4fb596d5a66633e.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"b43ee5b23a7cf90ba2dca725f4930f2a-ssl"
age: 33721
x-content-type-options: nosniff
cf-ray: 8f1dc4f1f8a77c8d-EWR
x-nf-request-id: 01JF2E0MTAQEAKAAWTYQ4ZFH89
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 6023.ccb3fff03c4fa91a.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
757 B 86ms
85ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6023.ccb3fff03c4fa91a.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"39ccbb757c413d78d0f9a1a8014d51bb-ssl-df"
age: 31869
x-content-type-options: nosniff
cf-ray: 8f1dc4f1f8a97c8d-EWR
x-nf-request-id: 01JF2E0MTD86X81YE02HSFNZ86
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 790.d7dc94c2ef6f512f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
859 B 131ms
130ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/790.d7dc94c2ef6f512f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"6ff1ada259784a3388a9c23908ebebdc-ssl-df"
age: 34810
x-content-type-options: nosniff
cf-ray: 8f1dc4f1f8aa7c8d-EWR
x-nf-request-id: 01JF2E0MTZ3XPGXE9H7DW9M5EH
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6831.3072668993ea221f.js Show response
www.zscaler.com/_next/static/chunks/ 1 KB
817 B 86ms
85ms Script
application/javascript 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/chunks/6831.3072668993ea221f.js

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/webpack-b78d7c3aa49f6203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7c416a32791e45716f8ef3dec7caa745-ssl-df"
age: 29721
x-content-type-options: nosniff
cf-ray: 8f1dc4f1f8ab7c8d-EWR
x-nf-request-id: 01JF2E0MTE7CJJ1E1V3R0G2MJK
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 440 KB
135 KB 290ms
79ms Script
application/javascript 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6524f78597d088f190890e00971f0b07e07433e704c449d09cf3aa7297d8c626

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sat, 14 Dec 2024 11:14:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 14 Dec 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 137219
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 image
www.zscaler.com/_next/ 19 KB
19 KB 190ms
189ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fimage.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fd41564413cfe94c87164c2a4902a573843f1e2367ddc93c62485d88b014b11

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f2f9687c8d-EWR
netlify-vary: query=height|position|url|fit|w|h|crop|q|quality|timestamp|fm|format|width
content-length: 19050
x-nf-request-id: 01JF2E0MZ64BNQ26R870AK03WD
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 28 KB
28 KB 307ms
306ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fzloader_cover_image.jpeg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c88c71934d2e43cf80d7e931804ecec7198178159a4c3888eec974ef26b18534

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f359a97c8d-EWR
netlify-vary: query=fm|w|h|height|q|quality|timestamp|url|fit|format|width|position|crop
content-length: 28288
x-nf-request-id: 01JF2E0N12RZCQ9AKVYTF8TFQ9
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 74 KB
74 KB 167ms
167ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fblog-tile-img-700x467-generic-code.jpg&w=600&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c64ed9cbd4857f5cd7171a9f0f6fe9fe619ed237a243d01cda750c3e7b74d484

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 27105
x-content-type-options: nosniff
cf-ray: 8f1dc4f359aa7c8d-EWR
netlify-vary: query=width|height|crop|timestamp|url|format|w|h|position|q|quality|fit|fm
content-length: 76013
x-nf-request-id: 01JF2E0N14BW51J1V5XAX972T7
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 3af0ea8ee1d54b3f.css Show response
www.zscaler.com/_next/static/css/ 80 KB
104 B 140ms
139ms Fetch
text/css 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/_next/static/css/3af0ea8ee1d54b3f.css

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/_next/static/chunks/main-8dadffc346739bd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"7a807c808a7b103144313c0e6c26f870-ssl-df"
age: 23703
x-content-type-options: nosniff
cf-ray: 8f1dc4f359ab7c8d-EWR
x-nf-request-id: 01JF2E0N13NAT1QW6ZW5VD8ADC
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; hit
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 image
www.zscaler.com/_next/ 238 KB
239 KB 579ms
579ms Image
image/avif 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zscaler.com/_next/image?url=https%3A%2F%2Fcms.zscaler.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2Fblogs%2Fremote_work%2520copy.jpeg&w=1920&q=75

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

416cb814af7408e0c40053f8834a1a0ff8343f5cb8607699f5ce4d29385d9df1

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
content-security-policy: script-src 'none'
cache-control: public,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f379bd7c8d-EWR
netlify-vary: query=height|position|url|fit|w|h|crop|q|quality|timestamp|fm|format|width
content-length: 244202
x-nf-request-id: 01JF2E0N1RAB3KBCEF1D5GXKWJ
date: Sat, 14 Dec 2024 11:14:16 GMT
cache-status: "Netlify Edge"; fwd=miss
content-type: image/avif
vary: Accept
server: cloudflare

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
306 B 291ms
109ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8f1dc4f4cb9befa5-EWR
access-control-allow-origin: *
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 7 KB
2 KB 82ms
81ms Script
application/javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=7971&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&callback=jQuery37105396227349324747_1734174856213&_=1734174856214
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 270bfd677d1d3f2a708baf53c0cbb5f2909f601a585785c37cc62f44470853b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-ray: 8f1dc4f4c83cac0f-YYZ
cached: true
content-encoding: gzip
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 getForm Show response
info.zscaler.com/index.php/form/ 7 KB
2 KB 86ms
86ms Script
application/javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=1944&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&callback=jQuery37105396227349324747_1734174856215&_=1734174856216
Requested by: Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad10b9a471d6c14afa1e652e147b8dac9e21ccca8269512f9e3ab6d21128eaed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cf-ray: 8f1dc4f4c83fac0f-YYZ
cached: true
content-encoding: gzip
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 417ms
159ms Script
application/x-javascript 23.13.172.203
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-172-203.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

Content-Encoding: gzip
ETag: "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 741
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Sat, 14 Dec 2024 11:14:16 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 13 Nov 2024 02:44:39 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 6934ae2b-4c76-4229-97d0-8f637b004b88.js Show response
j.6sc.co/j/ 4 KB
2 KB 494ms
184ms Script
application/javascript 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-205-106-73.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
etag: "afb8c61166e7f50fe6d7ab7b6377733c"
x-amz-version-id: uLuCr1hhLpJjZt0sFSB89FSJa4YqIrE7
expires: Sat, 14 Dec 2024 11:44:16 GMT
x-amz-cf-id: G4h9Mc3WkU4d0t-voMD87CrloD2SJ1z5nyZurJ1yfDsRIihFmJ2lZg==
date: Sat, 14 Dec 2024 11:14:16 GMT
last-modified: Tue, 02 May 2023 17:36:47 GMT
vary: Accept-Encoding
content-type: application/javascript
x-amz-meta-content-type: application/json
cache-control: private, max-age=1800
accept-ranges: bytes
content-length: 1178
x-amz-cf-pop: IAD50-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 1395e54b70b06b444656a2f40c135374.js Show response
ob.iseaskies.com/i/ 104 KB
38 KB 371ms
143ms Script
text/javascript 2600:9000:250a:9a00:c:d449:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:9a00:c:d449:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Caddy /
Resource Hash: 446fcb4b09d3317056eaf5ea7de5e959d01a60de6a7bc39de340a3f3ba33e17e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: "19fc4-xBKoJRSOLJ2Nz/Z0L9reIUkPIKw"
age: 12434
via: 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
expires: Sat, 14 Dec 2024 19:47:02 GMT
x-cache: Hit from cloudfront
content-length: 38842
x-amz-cf-id: TPJ05xzB0xej5xCeKg_VRFU3MzH3LYRfJA9oZ2aV3fyCktrRKjVAsw==
date: Sat, 14 Dec 2024 07:47:02 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: Caddy
x-amz-cf-pop: IAD12-P3

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/ 457 KB
111 KB 62ms
61ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9154d414a27fae4611f3f046d25d022a22f4404d1cf169d8f27874d85e0fa2df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: 9aIcs+q+3f1RyS4QXhbzeg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90C1CE91BE
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 86223
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 09:40:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 6b313eab-701e-002a-7a7a-41e6cf000000
cf-ray: 8f1dc4f5aafe7c9a-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 113775
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 forms2.css
info.zscaler.com/js/forms2/css/ 13 KB
3 KB 79ms
78ms Stylesheet
text/css 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "301120-3437-62370c030d900"
age: 5474
x-content-type-options: nosniff
cf-ray: 8f1dc4f5a8b4ac0f-YYZ
expires: Sat, 14 Dec 2024 15:14:16 GMT
accept-ranges: bytes
content-length: 2623
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-round.css
info.zscaler.com/js/forms2/css/ 4 KB
1 KB 57ms
56ms Stylesheet
text/css 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/css/forms2-theme-round.css

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "30111f-e46-62370c030d900"
age: 5474
x-content-type-options: nosniff
cf-ray: 8f1dc4f5a8b6ac0f-YYZ
expires: Sat, 14 Dec 2024 15:14:16 GMT
accept-ranges: bytes
content-length: 968
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 XDFrame Show response
info.zscaler.com/index.php/form/ Frame F425 2 KB
873 B 152ms
151ms Document
text/html 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/index.php/form/XDFrame

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8f1dc4f67913ac0f-YYZ
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:16 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b49a-7878-8885-fa7280aa0284/ 107 KB
22 KB 149ms
149ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/0190bafd-b49a-7878-8885-fa7280aa0284/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ea21177acdf53bc6e55d2b43c3f662df111f3907eb497f732aeae9cb55b4330

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: 0Uei8ghoHKFxTLqa5uzh9Q==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD16081D8AB9C8
age: 71308
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sun, 15 Dec 2024 11:14:16 GMT
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Fri, 06 Dec 2024 15:10:26 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 5ea14e0d-001e-006a-5ff0-47cf21000000
cf-ray: 8f1dc4f6c954efa7-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21981
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 forms2.min.js Show response
info.zscaler.com/js/forms2/js/ Frame F425 199 KB
0 0ms
0ms Script
application/x-javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.zscaler.com/js/forms2/js/forms2.min.js

Requested by

Host: info.zscaler.com
URL: https://info.zscaler.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://info.zscaler.com/index.php/form/XDFrame

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "303ea2-31b73-6265f10fde9e8"
age: 0
x-content-type-options: nosniff
cf-ray: 8f1dc4f0de73ac0f-YYZ
expires: Sat, 14 Dec 2024 15:14:15 GMT
date: Sat, 14 Dec 2024 11:14:15 GMT
content-type: application/x-javascript
last-modified: Fri, 08 Nov 2024 04:20:09 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 13 KB
3 KB 73ms
71ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: Zhl3NRfORxoyAD/Z53+4sQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90BE28DCD4
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 34383
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Thu, 28 Nov 2024 09:40:49 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 1f1e55cb-601e-009f-0c31-42eb30000000
cf-ray: 8f1dc4f7eb10efa7-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3003
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/ 64 KB
13 KB 114ms
113ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: iyZIdo3fYGB15RdO1v1ZMQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90BF9D865E
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 71308
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Thu, 28 Nov 2024 09:40:52 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d9b3fe45-801e-001d-5b27-424a60000000
cf-ray: 8f1dc4f82b52efa7-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 5 KB
2 KB 113ms
112ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: 21eDi1zDDFrr5h445fzg+A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD0F90BF3D82E5
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 8759
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: application/json
last-modified: Thu, 28 Nov 2024 09:40:51 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: db83d3e8-d01e-00c2-0219-421b34000000
cf-ray: 8f1dc4f82b53efa7-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1738
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 24 KB
4 KB 122ms
121ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 79920
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:16 GMT
content-type: text/css
last-modified: Thu, 28 Nov 2024 09:41:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 900259e0-401e-0044-34e9-414fe6000000
cf-ray: 8f1dc4f82b55efa7-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ct Show response
obs.iseaskies.com/ 4 KB
2 KB 282ms
95ms Script
text/javascript 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/ct?id=60409&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1734174857153&hl=2&op=0&ag=4270235709&rand=24969266062918285808811101075981239028322718526490265977910613680788568686112190220192&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDQwN10sWyJhYm5jaCIsMjBdLFstMjQsIltdIl0sWy0yOSwiLSJdLFstMzgsImksLTEsLTEsMSwwLDEsMCwwLDE4MCwyNTYsLTEsMCw3ODQuNSw3ODQuNSwxODQ5LDE4NDkiXSxbLTcwLCItIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwidHdpdHRlcjp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiXX0iXSxbLTE4LCJbMCwwLDAsMV0iXSxbLTE5LCJbMTcwLDE3MCwxNzAsMTcwLDAsMCwxLDI0LDI0LFwiLVwiLDE2MDAsMTIwMCwxNjAwLDEyMDAsMTYwMCwxMjg1LDE2MDAsMTIwMCwwLDAsMCwwLFwiLVwiLFwiLVwiLDE2MDAsMTIwMCwwXSJdLFstMjUsIi0iXSxbLTI2LCJ7XCJ0amhzXCI6MzUzMDE1MjIsXCJ1amhzXCI6MjY2NTQ4NDIsXCJqaHNsXCI6NDI5NDcwNTE1Mn0iXSxbLTI3LCJbMTAwLDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0zNiwiW1wiNC8zXCIsXCI0LzNcIl0iXSxbLTM5LCJbXCIyMDAzMDEwN1wiLDIsXCJHZWNrb1wiLFwiTmV0c2NhcGVcIixcIk1vemlsbGFcIixudWxsLG51bGwsdHJ1ZSw4LGZhbHNlLG51bGwsNSx0cnVlLHRydWUsbnVsbCwwLHRydWUsdHJ1ZV0iXSxbLTQxLCItIl0sWy02MSwie1wid2dzbFwiOlwiNDtwYWNrZWRfNHg4X2ludGVnZXJfZG90X3Byb2R1Y3Q7dW5yZXN0cmljdGVkX3BvaW50ZXJfcGFyYW1ldGVycztwb2ludGVyX2NvbXBvc2l0ZV9hY2Nlc3M7cmVhZG9ubHlfYW5kX3JlYWR3cml0ZV9zdG9yYWdlX3RleHR1cmVzO1wiLFwicGNmXCI6XCJiZ3JhOHVub3JtXCJ9Il0sWy02MywiLSJdLFszNywiWzMzMTYyMjQwNDksZnVuY3Rpb24obmV3VmFsdWUpIHtcbiAgICAgICAgICAgICAgYWRkQ29udGVudFdpbmRvd1Byb3h5KHRoaXMpXG4gICAgICAgICAgICAgIC8vIFJlc2V0IHByb3BlcnR5LCB0aGUgaG9vayBpcyBvbmx5IG5lZWRlZCBvbmNlXG4gICAgICAgICAgICAgIE9iamVjdC5kZWZpbmVQcm9wZXJ0eShpZnJhbWUsICdzcmNkb2MnLCB7XG4gICAgICAgICAgICAgICAgY29uZmlndXJhYmxlOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB3cml0YWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgdmFsdWU6IF9zcmNkb2NcbiAgICAgICAgICAgICAgfSlcbiAgICAgICAgICAgICAgX2lmcmFtZS5zcmNkb2MgPSBuZXdWYWx1ZVxuICAgICAgICAgICAgfV0iXSxbLTEsIi0iXSxbLTIwLCItIl0sWy00NCwiMCwwLDAsNSJdLFstNTEsIi0iXSxbLTU5LCJkZWZhdWx0Il0sWy03LCItIl0sWy0xMiwibnVsbCJdLFstMTUsIi0iXSxbLTIzLCIrIl0sWy00MiwiMTcyNDI5NzY1MyJdLFstNTAsIi0iXSxbLTY0LCJbMCxcIlwiLFtdXSJdLFstNjksIkxpbnV4IHg4Nl82NHxHb29nbGUgSW5jLnw4fDQ4fHwwIl0sWy02LCItIl0sWy04LCItIl0sWy0xMywiLSJdLFstMTYsIjAiXSxbLTI4LCJlbi1VUyxlbiJdLFstMzQsIi0iXSxbLTcxLCJhMDExMDAxMDEwMDEwMDEwMTAwMDEwMTAwMTExMTEwMTAwMDAxMCJdLFstMTQsIi0iXSxbLTMyLCItIl0sWy01MywiMTAwIl0sWy02OCwiLSJdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiaW50ZWwgaW5jLlwiLFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjEwLFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MTkzMDgyMDI3OSxcInNlY1wiOlwiXCJ9Il0sWy0yLCI5LGVBSFdYMS9mM3F6Q3Zia3V5bVF3Z2xJYUYzcElzZ0lJalNRKzhpS2dxSTBvc0lBaXBGRUVRUklrVWdkRVFRcFVvSlNBdENBcVNIOUd5eTdaV1orZXIvZCtlOTJid3NDU0QvMWUiXSxbLTIxLCItIl0sWy0zNywiLTE0NC02Ni0xODAtIl0sWy00NiwiMCJdLFstNDcsIkFtZXJpY2EvVmFuY291dmVyLGVuLUdCLGxhdG4sZ3JlZ29yeSJdLFstNjUsIi0iXSxbLTE3LCI0OCJdLFstMzMsIi0iXSxbLTQ1LCI2MjAsNjc3LDAsMCwwLDU2MiwwLDAsNjQ4LDAsMCwwLDAsMCwwLDAsMCwwLDAsNjg0LDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwIl0sWy00OSwiLSJdLFstNTIsIi0iXSxbLTU1LCIxIl0sWy00LCItIl0sWy0yMiwiW1wiblwiLFwiblwiXSJdLFstMzUsIlsxNzM0MTc0ODU3MTM1LDhdIl0sWy00MCwiMzMiXSxbLTU2LCJsYW5kc2NhcGUtcHJpbWFyeSJdLFstNTcsIldFMFpWMXhPY1ZoWFhWVmNTeGNGV2xaVVNVeE5YRjBIR1dKWVNobFlTVWxWUUdRWkVWeFBXRlVaV0UwWkJWaFhWbGRBVkZaTVNnY1pFUU1PQXdnTUNRb0pBUkFWR1FWWVYxWlhRRlJXVEVvSEF3Z0JBd29KRUJWWVRSbDRTMHRZUUJkUFhCa1JVVTFOU1VvREZoWldXeGRRU2x4WVNsSlFYRW9YV2xaVUZsQVdDQW9BREZ3TURWc09DVnNKRDFzTkRRMFBEQTlZQzE4TkNWb0lDZ3dLRGcwWFUwb0RDQU1QRGdFSkRoQVZXRTBaU3hrUlVVMU5TVW9ERmhaV1d4ZFFTbHhZU2xKUVhFb1hXbFpVRmxBV0NBb0FERndNRFZzT0NWc0pEMXNORFEwUERBOVlDMThOQ1ZvSUNnd0tEZzBYVTBvRENBTU9DdzBCQVJBPSJdLFstNTgsIi0iXSxbLTY2LCJnZW9sb2NhdGlvbixjaHVhZnVsbHZlcnNpb25saXN0LGNyb3Nzb3JpZ2luaXNvbGF0ZWQsc2NyZWVud2FrZWxvY2sscHVibGlja2V5Y3JlZGVudGlhbHNnZXQsc2hhcmVkc3RvcmFnZXNlbGVjdHVybCxjaHVhYXJjaCxjb21wdXRlcHJlc3N1cmUsY2hwcmVmZXJzcmVkdWNlZHRyYW5zcGFyZW5jeSx1c2IsY2hzYXZlZGF0YSxwdWJsaWNrZXljcmVkZW50aWFsc2NyZWF0ZSxzaGFyZWRzdG9yYWdlLHJ1bmFkYXVjdGlvbixjaHVhZm9ybWZhY3RvcnMsY2hkb3dubGluayxvdHBjcmVkZW50aWFscyxwYXltZW50LGNodWEsY2h1YW1vZGVsLGNoZWN0LGF1dG9wbGF5LGNhbWVyYSxwcml2YXRlc3RhdGV0b2tlbmlzc3VhbmNlLGFjY2VsZXJvbWV0ZXIsY2h1YXBsYXRmb3JtdmVyc2lvbixpZGxlZGV0ZWN0aW9uLHByaXZhdGVhZ2dyZWdhdGlvbixpbnRlcmVzdGNvaG9ydCxjaHZpZXdwb3J0aGVpZ2h0LGxvY2FsZm9udHMsY2h1YXBsYXRmb3JtLG1pZGksY2h1YWZ1bGx2ZXJzaW9uLHhyc3BhdGlhbHRyYWNraW5nLGNsaXBib2FyZHJlYWQsZ2FtZXBhZCxkaXNwbGF5Y2FwdHVyZSxrZXlib2FyZG1hcCxqb2luYWRpbnRlcmVzdGdyb3VwLGNod2lkdGgsY2hwcmVmZXJzcmVkdWNlZG1vdGlvbixicm93c2luZ3RvcGljcyxlbmNyeXB0ZWRtZWRpYSxneXJvc2NvcGUsc2VyaWFsLGNocnR0LGNodWFtb2JpbGUsd2luZG93bWFuYWdlbWVudCx1bmxvYWQsY2hkcHIsY2hwcmVmZXJzY29sb3JzY2hlbWUsY2h1YXdvdzY0LGF0dHJpYnV0aW9ucmVwb3J0aW5nLGZ1bGxzY3JlZW4saWRlbnRpdHljcmVkZW50aWFsc2dldCxwcml2YXRlc3RhdGV0b2tlbnJlZGVtcHRpb24saGlkLGNodWFiaXRuZXNzLHN0b3JhZ2VhY2Nlc3Msc3luY3hocixjaGRldmljZW1lbW9yeSxjaHZpZXdwb3J0d2lkdGgscGljdHVyZWlucGljdHVyZSxtYWduZXRvbWV0ZXIsY2xpcGJvYXJkd3JpdGUsbWljcm9waG9uZSJdLFstNSwiLSJdLFstMTAsIi0iXSxbLTQzLCIwMDAwMDAwMTAxMDAwMDAxMDAxMTEwMTEwMDEwMTEwMTAwMDAwMTAiXSxbLTYyLCI4MCJdLFsiYm5jaCIsMTYzXSxbLTMsIltcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIl0iXSxbLTksIisiXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTMxLCJmYWxzZSJdLFstNDgsIjAsMCJdLFstNTQsIntcImhcIjpbXCJfM1wiLFwiMjg3Mjg5OTMyMFwiXSxcImRcIjpbXSxcImJcIjpbXCJfMVwiLFwiMjQyNTY2NTQwMVwiLFwiMTE3NjcyODc4N1wiLFwiMzk1NjEyMzIwN1wiLFwiXzJcIixcIjI4MzI2MDI2NzhcIl0sXCJzXCI6MX0iXSxbLTYwLDIwOF0sWy02NywiLSJdLFsiZGRiIiwiMCw5LDAsMCwxLDAsMCwwLDAsMCwxLDAsMCwwLDMsMCwwLDAsMSwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDEsMSwwLDEsMCwwLDAsMSwyLDEyLDAsMSwwLDAsMCwwLDAsMCwwLDAsMSwwLDEsMCw4LDAsMCwwLDAsMCwwLDAsMCwxLDEsMSJdLFsiY2IiLCIwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwxMiwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwxLDAsMCwwLDAsMSwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDgsMCwxLDAsMCwwLDAsMCwzLDAsMCwwIl1d&dep=0&pre=0&sdd=&cri=oBYNbWeYTU&pto=1986&ver=62&gac=-&mei=&ap=&fe=1&duid=1.1734174857.8el2N6GufhfCPquS&suid=1.1734174857.epjcYM360LrO1sJk&tuid=1.1734174857.7BlzeYDgypMFAwD4&fbc=-&gtm=WyJHQTQgSUQgUmVjb3JkaW5nIiwiT25lVHJ1c3RMb2FkZWQiLCJPcHRhbm9uTG9hZGVkIiwiT25lVHJ1c3RHcm91cHNVcGRhdGVkIl0%3D&it=85%2C1379%2C425&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 3f7b44e0bcec640ab0b2cb7f1c08dd2acd8537da4eb64f2c8e67ab5ab4250f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: https://www.zscaler.com
content-encoding: gzip
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
content-length: 1363
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/javascript

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 87ms
86ms Script
application/javascript 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111d7"
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 14:14:17 GMT
accept-ranges: bytes
content-length: 18830
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
539 B 79ms
79ms Fetch
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 71309
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/svg+xml
last-modified: Thu, 12 Dec 2024 20:18:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 510f9333-f01e-00b3-7c1c-4d690d000000
cf-ray: 8f1dc4f99deeefa7-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 Zscaler_BrandAssets_LogoLockup.png
cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/64c4b265-4053-486c-99b3-8526161810a0/fbe5e17f-6402-4039-8134-3b2c3d79c7fd/ 30 KB
31 KB 85ms
84ms Image
image/png 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/0ab9c0b7-247a-4ae1-b653-bc1c2e1efb99/64c4b265-4053-486c-99b3-8526161810a0/fbe5e17f-6402-4039-8134-3b2c3d79c7fd/Zscaler_BrandAssets_LogoLockup.png

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce99852044b59bb736c57ef96bc2425a82ba6106f9301f9c310733f7fecfcbc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: /KEd6056Cb08C23q097ANg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DC230BCB380E19
age: 61306
cf-cache-status: HIT
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/png
last-modified: Thu, 01 Feb 2024 09:54:34 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: fcac2d9d-c01e-0055-1ea6-cd78fd000000
cf-ray: 8f1dc4f9bdde7c9a-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31112
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 98ms
97ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 7162
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/svg+xml
last-modified: Thu, 12 Dec 2024 20:18:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: b4d749e1-c01e-0038-6b5b-4dd2d3000000
cf-ray: 8f1dc4f9edfe7c9a-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
702 B 323ms
107ms XHR
application/json 68.67.160.26
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.26 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 157.254.49.177; 157.254.49.177; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
an-x-request-uuid: bca7c6f9-da1b-43be-b8df-86b918430834
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 / Show response
c.6sc.co/ 7 B
193 B 79ms
76ms XHR
text/html 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-205-106-73.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.zscaler.com
content-length: 7
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 23 B
316 B 314ms
127ms XHR
text/html 2600:1408:c400:d::17cd:6a49
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:d::17cd:6a49 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: bad0b434fdb9b4c1996639fee84f05ed0aec4037eb51f40a56142878bcf4cd93

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:4958:1420:152::177
expires: Sat, 14 Dec 2024 11:14:17 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1734174857433_400219721_778609744_17_665_23_57_219";dur=1
access-control-allow-origin: https://www.zscaler.com
content-length: 23
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/html
vary: Origin

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 770 B
664 B 346ms
152ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: c1a5d90154c86803f67584209b4bd0385e51dd95e7b12a4e7cfa4e645dd72186

Request headers

Authorization: Token 1dc729230d6b8d19bab5e6236d81f60c4dca0823
X-6s-CustomID: WebTag 6934ae2b-4c76-4229-97d0-8f637b004b88
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.zscaler.com
content-length: 405
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 351ms
124ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.zscaler.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Sat, 14 Dec 2024 11:14:17 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET 98c05d32-4e2a-4bc6-83c1-6d7e079e7813
https://www.zscaler.com/ Frame 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 434 KB
138 KB 71ms
70ms Script
application/javascript 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7ebe4c47a3c72f628aa1633221f01d98ec9549c6d1ea05034f30ec70f877fd2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 140703
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 431 KB
137 KB 98ms
97ms Script
application/javascript 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5367592d95c7be5bfd8852f1e69b88d4b32fa21a0e599ed493bb2e673dcae43f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 139839
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 198ms
54ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

240355f4e85792fb5c1e46a942e6d797a078d39f8717dfbab666e4e80cb4dd8d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-dqErfBvU' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-dqErfBvU' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=55, rtx=0, c=23, mss=1232, tbw=5759, tp=10, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: YPUvKmRx8gCCQspeTPP9ODDhWgUVFWYDuuYNVjb7v2shTki9R4Ak06LSZFKKoe/Q+13PNHssdI3T3GiMgjC5ag==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62283
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 244ms
61ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 841156EF81754A57BDFC47D181784028 Ref B: YMQ01EDGE0317 Ref C: 2024-12-14T11:14:17Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 305 KB
102 KB 87ms
86ms Script
application/javascript 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

621212e2d47d4818dd10cf1e08011efdd647c40c409dcc708d856f5fd966846d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 14 Dec 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 103904
x-xss-protection: 0
server: Google Tag Manager

GET
H3

200

/
www.google.ca/pagead/1p-conversion/812494211/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsm...
https://www.google.com/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08Wx...
https://www.google.ca/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxA...

42 B
64 B

72ms
71ms

Image
image/gif

2607:f8b0:400d:c02::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIhsv64pCnigMVQgiICR3ccQXCMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dUfUxsIFEAAawkwvZZFcM0gznUBks6Q&random=518752184&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Server

2607:f8b0:400d:c02::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.ca/pagead/1p-conversion/812494211/?label=v1JUCMXA-c8ZEIPbtoMD&guid=ON&script=0&ct_cookie_present=false&random=1410011820&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAg&pscrd=IhMIhsv64pCnigMVQgiICR3ccQXCMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dUfUxsIFEAAawkwvZZFcM0gznUBks6Q&random=518752184&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 tc_imp.gif
obs.iseaskies.com/tracker/ 43 B
79 B 52ms
50ms Image
image/gif 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.iseaskies.com/tracker/tc_imp.gif?e=37dfbd8ee84e001269eac632ee4f8f9a9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5811896d2e17071a10acf9f29f674d8b818853793a1fff2c7301823dd9609201625075c55b000c32565cc0bf6b4b77be26bb25cb43e2913bf05365a80428721bdb57ee46f497d6da3fbb2807ff7ecaa8556d8e0e3143714493d60363f260b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c44ca4825b6a3e5aa22a76da50eda7cf54a6863c89777256e1d0cd71ed0d906f50732e690b73255015ab2fb523c9bdc05457f54065258fcd135700e5fe6a5142c93aaf62f8ee04572032cbbc5f4c2c935e7c2db59ec489f5e2c7edfaacff4e43e828fe13ec13407d4afcd2b4917a6303efac6426de7dfaf208f02ae12ba831dc44dd9d36d9a6d279c9b22da6198cefab6cdb3f11338ae6bf2fbb9234e2bfb94248efe01e0141a54954309da8dcec8cff18021853bd79fa29873f867342483692c978490446adbe462a007e0dc55987aac7b455b1bdd79b10ecac0bf69f79128cc1deec0dad776c14f5361f1591a58724c3e89ec65b3058c9fc964b59966ec9d209adab8af26c1f0e61f3e3ea9ca1e0a9bb7490251baacf537b6309bf64eadb578e73ee264d741de06c5b42e944235eebcc13e6a7e64436a584e0bb8bfdd2a8b55e601171c77eabe5d818a041ea9e9ace6e5399ca99da894f2bdec59532ead15f5ea003bdd071c4fc5694f6c7eea69ed2a0bc880c260837cd4278db72dcdb80d99670e2120027f0f9dc0e4db3b67549a18459dcfd8bbb0c952199fb0bd7e94d3727bd8d7122074fa99da4a3cb4208c43821be03d870fdcc817e4a735e39f94cf9e476382fc2937c72ff29fbab917826d331501956f4758b4a44187b948c8e79dbf119bdfd1406e7602dd2fb717e910ebd57b9c20423f403d7e7be05d8a893652a73a80fda65ca4cc4b8c0831d0103f56c4facd181eab28a19c1ac8062f014dbf3f2d85abdf6dcc4939e8d959f4b6a9a8c902a72b246561f6653940ded05a4eb0578ae2d36fcb8afe045d60b03e714c55b34803b7ddb7474ff237268ac8d953c3d5a6dd0d77f822b104695fd05c632284c20e4097c4a38bb7f001eb39a567c93781d240d6e7f83725b0c513938cb4b3d8e1898e6717cef42f5698368e18c21db2a639a2cfd1c728e4d3c7f2fa5a69c5a2f4f446c65394404f216b28b8cc6665873cb40ac78060fc4b6bb720&cri=oBYNbWeYTU&ts=312&cb=1734174857465
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
pragma: no-cache
content-type: image/gif

GET 7fdb3e02-edbf-4e93-a1b0-d2c39a832c3d
https://www.zscaler.com/ Frame 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 140ms
139ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:17 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 166ms
165ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22ab9750bca4342498694e239e304dd3a9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%221dc729230d6b8d19bab5e6236d81f60c4dca0823%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%226934ae2b-4c76-4229-97d0-8f637b004b88%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:17 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 211 KB
76 KB 65ms
64ms Script
application/javascript 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c&gtm=45je4cc1v883639532za200zb71607006

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7ea3d55a4fe561dd1479542608e0374371f86f94e589ccedc3910c415effc9a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 14 Dec 2024 11:14:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 14 Dec 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 77437
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
analytics.google.com/g/ 0
0 208ms
56ms Fetch
text/plain 2001:4860:4802:38::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je4cc1v883639532za200zb71607006&_p=1734174856096&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&gdid=dYWJhMj&cid=1242532801.1734174858&ecid=1752987186&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1734174857&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&dt=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&en=CQ&_fv=1&_nsi=1&_ss=1&_ee=1&up.cq_category=bots&tfd=2454
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
554 B 346ms
153ms Ping
text/plain 2607:f8b0:400d:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-10SPJ4YJL9&cid=1242532801.1734174858&gtm=45je4cc1v883639532za200zb71607006&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c04::9d Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame EE7F 0
0 238ms
72ms Document
text/html 2607:f8b0:4004:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-10SPJ4YJL9&gacid=1242532801.1734174858&gtm=45je4cc1v883639532za200zb71607006&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1940401399

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 14 Dec 2024 11:14:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 211ms
67ms Image
image/gif 2607:f8b0:400d:c02::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-10SPJ4YJL9&cid=1242532801.1734174858&gtm=45je4cc1v883639532za200zb71607006&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1611083140

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 95ms
94ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=ipv6&q=%7B%22address%22%3A%222001%3A4958%3A1420%3A152%3A%3A177%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:17 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H3 200 collect
www.google.com/ccm/ 0
0 256ms
69ms Ping
text/plain 2607:f8b0:4004:c1d::93
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&scrsrc=www.googletagmanager.com&frm=0&rnd=1188334606.1734174858&dt=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&auid=1035420455.1734174858&navt=n&npa=0&did=dYWJhMj&gdid=dYWJhMj&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734174857665&tfd=2496&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::93 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/ 5 KB
2 KB 256ms
66ms Script
text/javascript 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1734174857658&cv=11&fst=1734174857658&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22ac63e88ac5429c4e81233b3bbd0209bc749a32fb112d1c90f174df52089d5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2350
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 812494211
td.doubleclick.net/td/rul/ Frame 5ED2 0
0 140ms
74ms Document
text/html 2607:f8b0:4004:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/812494211?random=1734174857658&cv=11&fst=1734174857658&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 14 Dec 2024 11:14:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/812494211/ 6 KB
3 KB 74ms
73ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/812494211/?random=1734174857728&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

46cba9639c8f0d177a80dd427f8b869b49f6b62193e2e781d8cc67be1782e61f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2706
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 812494211
td.doubleclick.net/td/rul/ Frame 28B8 0
0 133ms
74ms Document
text/html 2607:f8b0:4004:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/812494211?random=1734174857728&cv=11&fst=1734174857728&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 14 Dec 2024 11:14:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 321ms
99ms Script
text/javascript 2607:f8b0:400d:c00::64
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-6177009-1&l=dataLayer&cx=c&gtm=45je4cc1v883639532za200zb71607006

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::64 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
age: 791
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 13:01:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:01:07 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 295018432.js Show response
bat.bing.com/p/action/ 364 B
411 B 61ms
59ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/295018432.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

cce2184ec089babc70ded47b8474c543f6a5ff013e4bfd9dbae8689489bb13ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CBF93E01AB224DF7B610C32A4482EBB4 Ref B: YMQ01EDGE0317 Ref C: 2024-12-14T11:14:17Z
x-cache: CONFIG_NOCACHE
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 1778897272132032 Show response
connect.facebook.net/signals/config/ 81 KB
16 KB 52ms
52ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1778897272132032?v=2.9.179&r=stable&domain=www.zscaler.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2905d3d00589eb904d7eafb9d7fbae392cdf9c5f99ec54c4913797bea58705b4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-G0LFErdz' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 14 Dec 2024 11:14:17 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-G0LFErdz' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=55, rtx=0, c=77, mss=1232, tbw=71743, tp=66, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: qHu6IJXArHJpGQose8xcrJUJIlaw6G9ClYWjPgffJdFwv2rMF4mWcZe8KQ9IMDVSr8M2s+oSA+1P+bbh5hlE6g==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 16505
x-xss-protection: 0
origin-agent-cluster: ?1

GET
DATA 200
OK truncated
/ Frame D7CB 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D7CB 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3

200

/
www.google.ca/pagead/1p-conversion/812494211/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1...
https://www.google.com/pagead/1p-conversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925...
https://www.google.ca/pagead/1p-conversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=1019256...

42 B
64 B

69ms
69ms

Image
image/gif

2607:f8b0:400d:c02::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIvKWA45CnigMVTA2ICR3Lty5KMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU1YkR4NlBHa2pfN1A4Qk5lbHNRbTJtempQemRBLVlyNVhjeUhqbEhrM19TVWxoR2xWWFNRYw&is_vtc=1&cid=CAQSGwCa7L7d4Fu0f7BGOOBqIzWWuWDd3P-XmtGC_Q&random=1610180324&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Server

2607:f8b0:400d:c02::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.ca/pagead/1p-conversion/812494211/?random=370484112&cv=11&fst=1734174857728&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&label=v1JUCMXA-c8ZEIPbtoMD&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&gtm_ee=1&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIvKWA45CnigMVTA2ICR3Lty5KMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhhodHRwczovL3d3dy56c2NhbGVyLmNvbS9CV0NoRUlnUGIwdWdZUWhvUzB2N0tNbjV2NEFSSXNBRjhQWmU1YkR4NlBHa2pfN1A4Qk5lbHNRbTJtempQemRBLVlyNVhjeUhqbEhrM19TVWxoR2xWWFNRYw&is_vtc=1&cid=CAQSGwCa7L7d4Fu0f7BGOOBqIzWWuWDd3P-XmtGC_Q&random=1610180324&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 0
bat.bing.com/action/ 0
359 B 64ms
63ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=295018432&Ver=2&mid=972b39d9-cf7e-4ccb-8177-c5e4aadded74&bo=1&sid=8f4f57a0ba0c11ef91c657f1e85296df&vid=8f4f9e00ba0c11efb0fb499d13cd06e8&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&p=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&r=&lt=825&evt=pageLoad&sv=1&cdb=AQET&rn=352938

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F82827A65F804B45B0D24EBF7D82BFD0 Ref B: YMQ01EDGE0317 Ref C: 2024-12-14T11:14:17Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 14 Dec 2024 11:14:17 GMT

GET
H2 204 0
bat.bing.com/action/ 0
230 B 127ms
127ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=295018432&Ver=2&mid=972b39d9-cf7e-4ccb-8177-c5e4aadded74&bo=2&sid=8f4f57a0ba0c11ef91c657f1e85296df&vid=8f4f9e00ba0c11efb0fb499d13cd06e8&vids=0&msclkid=N&ec=CHEQ&el=Invalid_Users&ev=0&ea=Invalid_Users&en=Y&p=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&sw=1600&sh=1200&sc=24&evt=custom&cdb=AQET&rn=312842

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9503E47E34A04C53AC20C5B33768E31B Ref B: YMQ01EDGE0317 Ref C: 2024-12-14T11:14:17Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 14 Dec 2024 11:14:17 GMT

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 214ms
56ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&rl=&if=false&ts=1734174857879&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1734174857877.584887807886278050&ler=empty&cdl=API_unavailable&it=1734174857801&coo=false&rqm=GET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=64, rtx=0, c=23, mss=1232, tbw=5807, tp=11, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
193 B 344ms
187ms Image
image/png 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1778897272132032&ev=CHEQ&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&rl=&if=false&ts=1734174857879&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1734174857877.584887807886278050&ler=empty&cdl=API_unavailable&it=1734174857801&coo=false&rqm=FGET

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7448224300907822985"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: bcE6Eb6AViaz6FBGC0brViW39clQIu9zh6LIZOV2z8jMA6Bk5VTDOUYg2pH8h7f6N9ZYOwu5hMEngyPvBOwmFw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7448224300907822985", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=23, mss=1232, tbw=6175, tp=14, tpl=0, uplat=89, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.google.com/pagead/1p-user-list/812494211/ 42 B
64 B 72ms
71ms Image
image/gif 2607:f8b0:4004:c1d::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/812494211/?random=1734174857658&cv=11&fst=1734174000000&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dKB-JJt7Ctl4yJVR80XP5kZrtElZw0Q&random=347752526&rmt_tld=0&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::93 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/812494211/ 42 B
64 B 69ms
68ms Image
image/gif 2607:f8b0:400d:c02::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/812494211/?random=1734174857658&cv=11&fst=1734174000000&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v882815967za200zb71607006&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&hn=www.googleadservices.com&frm=0&tiba=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1035420455.1734174858&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dKB-JJt7Ctl4yJVR80XP5kZrtElZw0Q&random=347752526&rmt_tld=1&ipr=y

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 14 Dec 2024 11:14:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
419 B 88ms
88ms XHR
text/plain 2607:f8b0:400d:c00::64
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1093591911&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&ul=en-ca&de=UTF-8&dt=Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1839664222&gjid=1040341541&cid=1242532801.1734174858&tid=UA-6177009-1&_gid=55905656.1734174858&_r=1&gtm=457e4cc1z8883639532za200zb883639532&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&jsscut=1&z=1342787121

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::64 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.zscaler.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Dec 2024 11:14:18 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.zscaler.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
519 B 258ms
257ms XHR
application/json 3.171.76.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.76.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-76-19.iad89.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.zscaler.com/

Response headers

x-amz-apigw-id: Cx1FtHlYIAMEEsQ=
x-amzn-trace-id: Root=1-675d688a-51206a086c903c70203551b7;Parent=6e043d3375e05396;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 2e222583-e77a-402b-b27f-60f74d09fd7f
via: 1.1 17bd0a3b88141b04bc745d7ececd22ee.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: CFcRSkQAWMBIdYo1ErVBD-ZzcPblWQTdtM-campnMrddmcSQ2NT_3Q==
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
x-amz-cf-pop: IAD89-P4
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 69ms
68ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A2264.199998855591%2C%22duration%22%3A700.6000003814697%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A2264.199998855591%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A2964.7999992370605%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=&d=1&v=1.1.29

Requested by

Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:18 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 317ms
88ms Preflight
application/json 3.171.76.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.76.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-76-19.iad89.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Sat, 14 Dec 2024 11:14:18 GMT
via: 1.1 17bd0a3b88141b04bc745d7ececd22ee.cloudfront.net (CloudFront)
x-amz-apigw-id: Cx1FsHugIAMEA6w=
x-amz-cf-id: Ikh2fVru3HBJsy_Yzlm3zDWd1YnuoSnhLNSg4yhBZuTfc4VExrisFg==
x-amz-cf-pop: IAD89-P4
x-amzn-requestid: cc9d8c90-bd9e-426b-a20f-aa6c85790a94
x-cache: Miss from cloudfront

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 264ms
111ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2316eedc39d2ae71b2098be3e91ad3662cb1b70d42f6c61ebb6ab5beefd919b6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: Q8AFTvKb8EtoOgGtrVmzLCMTAh5swpvC
etag: W/"5b11ce08c51a9e4b3f4bbe37deea19c1"
age: 72943
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: IrMKHR4IS2Oy5luluR_Euxa3XjXDf5AfWjlehzlz9AqGTyBQyl087Q==
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/javascript
last-modified: Fri, 13 Dec 2024 14:58:23 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
via: 1.1 54441a47cd4b0e969c790a779569cec4.cloudfront.net (CloudFront)
cf-ray: 8f1dc5012c96aac8-YYZ
x-amz-cf-pop: YTO53-P1
server: cloudflare

GET
H2 200 117186981.js Show response
cdn.intellimize.co/snippet/ 504 KB
109 KB 245ms
50ms Script
application/javascript 151.101.66.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.intellimize.co/snippet/117186981.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

916031ed0f866bb0c4eedda4543b310d7aaba31e72f398ff5f110e64fbc607a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=0, must-revalidate
content-encoding: gzip
etag: "011f435fde03267ee1d2d691f61988cd2--gzip"
age: 2
x-timer: S1734174858.480249,VS0,VE1
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 111273
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/javascript;charset=utf-8
x-served-by: cache-yul1970077-YUL
x-cache-hits: 1
vary: Intellimize-Namespace, Intellimize-StatusModule, Accept-Encoding

GET
H2 200 favicon-32x32.ico
www.zscaler.com/favicons/ 4 KB
995 B 170ms
169ms Other
image/vnd.microsoft.icon 2606:4700:4400::6812:2215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zscaler.com/favicons/favicon-32x32.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2215 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

strict-transport-security: max-age=31536000; preload
cache-control: public,max-age=0,must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"875ed25f85201afbfc383f6b833f32c5-ssl"
age: 37382
x-content-type-options: nosniff
cf-ray: 8f1dc5007b637c8d-EWR
x-nf-request-id: 01JF2E0Q2VSARWB3CETXERX96M
date: Sat, 14 Dec 2024 11:14:18 GMT
cache-status: "Netlify Edge"; hit
content-type: image/vnd.microsoft.icon
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 75ms
75ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A17%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:18 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
147 B 66ms
64ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
16 B 114ms
112ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
614 B 232ms
231ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 27fdca9eafaee67c002005902aab15d2d51730420247b887550076c60bc55b63

Request headers

Authorization: Bearer e6609b6e9a1669129391
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"cb-mQox+vylwLO5ps5X3svrjb3EXdc"
apigw-requestid: Cx1FxhwzvHcESoA=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: eTNrGZvSgz--0kBhkl_homuTbIudP16WXnxTmoa3pHK5goQVu63Npw==
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
server-timing: cfExtPri
via: 1.1 9b4290f9c8982cac782653af1b9237a0.cloudfront.net (CloudFront)
cf-ray: 8f1dc50389b3a1fe-YYZ
access-control-allow-origin: https://www.zscaler.com
x-amz-cf-pop: YTO53-P1
x-powered-by: Express
server: cloudflare

GET
H2 200 storage.html
117186981.intellimizeio.com/ Frame A23E 0
0 317ms
88ms Document
text/html 3.227.183.172
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://117186981.intellimizeio.com/storage.html

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.227.183.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-227-183-172.compute-1.amazonaws.com

Software

/ Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://www.zscaler.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 5628
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:18 GMT
etag: W/"15fc-Uk1A5QrccB7iUltcerqKsVx8Uo0"
strict-transport-security: max-age=15552000; includeSubDomains
x-powered-by: Express

POST
H2 200 117186981 Show response
api.intellimize.co/context-v2/ 552 B
642 B 409ms
141ms Fetch
application/json 52.0.148.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/context-v2/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.0.148.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-148-147.compute-1.amazonaws.com

Software

Resource Hash

eb39b08e053eaf04c0b9690265b21e3d8a6e5e834c59cb7c5ce37f0ccb0a0856

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:18 GMT
content-type: application/json
vary: Accept-Encoding, Origin

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 262ms
110ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.zscaler.com
alt-svc: h3=":443"; ma=86400
apigw-requestid: Cx1FvhkivHcEPCw=
cf-cache-status: DYNAMIC
cf-ray: 8f1dc502d96da1fe-YYZ
date: Sat, 14 Dec 2024 11:14:18 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 a6ab43e67443a712b540406c85b6af86.cloudfront.net (CloudFront)
x-amz-cf-id: YUFLctSMRIHhW0yj570q2MlJg6LpFe_rXLenPk2whqFU7qUsw2KcUA==
x-amz-cf-pop: YTO53-P1
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 49 KB
15 KB 278ms
120ms Script
application/javascript 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=A2aW0Q==, md5=JRurSHzL3UB0yE1Wjm0Zqg==
cf-cache-status: DYNAMIC
etag: W/"251bab487ccbdd4074c84d568e6d19aa"
age: 1939
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Sat, 14 Dec 2024 11:42:00 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 50634
server-timing: cfExtPri
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: application/javascript
last-modified: Wed, 06 Nov 2024 05:44:23 GMT
priority: u=3,i=?0
x-guploader-uploadid: AFiumC6LDW146ARXe9ISJmZTKj-SXpjLY3SZAf7UrCH-aggjVYwPRg1WJb-8fVRaGoZ4rQPz18WV19Y
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
cf-ray: 8f1dc50618c00f3d-EWR
x-goog-generation: 1730871862939881
server: cloudflare

GET
H3 200 / Show response
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ 3 KB
2 KB 354ms
172ms Fetch
text/javascript 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

9d8415c5f1af85f7d369637172111e499c703136b8150cba9854a59dfe70e740

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: 41acad8704fb7994af6c1734174858
_vtok: MTU3LjI1NC40OS4xNzc=
visited-url: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
Referer: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: text/javascript
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8f1dc507be6c7295-EWR
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/ Frame 0
0 241ms
100ms Preflight
text/html 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64e6fa9ecd8305533d00dac1/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url
access-control-allow-origin: https://www.zscaler.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8f1dc505fea8428b-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:19 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H2 200 user-alias Show response
log.intellimize.co/ 3 B
325 B 562ms
225ms Fetch
application/json 52.89.27.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/user-alias

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.89.27.251 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-89-27-251.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 117186981 Show response
api.intellimize.co/prediction/ 68 B
379 B 122ms
121ms Fetch
application/json 52.0.148.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.intellimize.co/prediction/117186981

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.0.148.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-148-147.compute-1.amazonaws.com

Software

Resource Hash

ee743f4334f5efe935a3448412258a387e91186b7b3ad237bd82f3061b24afa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 logger
log.intellimize.co/ 3 B
316 B 489ms
171ms Ping
application/json 52.89.27.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.89.27.251 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-89-27-251.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: application/json
vary: Accept-Encoding, Origin

POST
H2 200 logger
log.intellimize.co/ 3 B
315 B 489ms
171ms Ping
application/json 52.89.27.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://log.intellimize.co/logger

Requested by

Host: cdn.intellimize.co
URL: https://cdn.intellimize.co/snippet/117186981.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.89.27.251 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-89-27-251.us-west-2.compute.amazonaws.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.zscaler.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.zscaler.com
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: application/json
vary: Accept-Encoding, Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 72ms
72ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A18%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:19 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 121ms
121ms Preflight
text/html 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.zscaler.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.zscaler.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8f1dc5074f9f428b-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 14 Dec 2024 11:14:19 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 321 B
649 B 124ms
123ms Fetch
application/json 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Authorization: bearer 370c892e688e1744cd312ed1426b3a
Referer: https://www.zscaler.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"141-mLq6O+j3ZcyvZxAx4AvrvpOh24w"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 14 Dec 2024 11:14:19 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8f1dc5080e8f7295-EWR
access-control-allow-origin: https://www.zscaler.com
x-powered-by: Express
server: cloudflare

GET
BLOB 200
OK bd973169-558b-4821-a7aa-e09b8b0a0dd8 Show response
https://www.zscaler.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.zscaler.com/bd973169-558b-4821-a7aa-e09b8b0a0dd8
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d8415c5f1af85f7d369637172111e499c703136b8150cba9854a59dfe70e740

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/javascript
Content-Length: 3033

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 96ms
95ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:20 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:20 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 89ms
87ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:20 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 99ms
99ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:21 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:21 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 72ms
71ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A21%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:22 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:22 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 mon Show response
obs.iseaskies.com/ 0
39 B 83ms
82ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.iseaskies.com/mon
Requested by: Host: ob.iseaskies.com
URL: https://ob.iseaskies.com/i/1395e54b70b06b444656a2f40c135374.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.zscaler.com/

Response headers

access-control-allow-origin: https://www.zscaler.com
content-length: 0
date: Sat, 14 Dec 2024 11:14:22 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE

GET img.gif
b.6sc.co/v1/beacon/ 0
0

GET app.js
acsbapp.com/apps/app/dist/js/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 75ms
74ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A23%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:24 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:24 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 81ms
63ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A24%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%228007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.zscaler.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 14 Dec 2024 11:14:25 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 14 Dec 2024 11:14:25 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/98c05d32-4e2a-4bc6-83c1-6d7e079e7813

Domain: www.zscaler.com
URL: blob:https://www.zscaler.com/7fdb3e02-edbf-4e93-a1b0-d2c39a832c3d

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A22%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Domain: acsbapp.com
URL: https://acsbapp.com/apps/app/dist/js/app.js

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1ad74790-dcc0-4e76-8226-b042f0010552&session=83f2944b-9acc-4216-8ef3-cf75534aa713&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2014%20Dec%202024%2011%3A14%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Zloader%202.9.4.0%20implemented%20a%20custom%20DNS%20tunneling%20protocol%20combined%20with%20TLS%20encryption%20to%20evade%20network%20detection.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Technical%20Analysis%20of%20Zloader%202.9.0.4%20%7C%20ThreatLabz%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&pageViewId=f712094b-3e3b-44df-80c9-9e3821bbb1ae&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&ipv6=2001%3A4958%3A1420%3A152%3A%3A177&v=1.1.29

Verdicts & Comments Add Verdict or Comment

90 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

24 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.info.zscaler.com/	1970-01-21 01:42:56	Name: __cf_bm Value: 0PUC0dfmavgvDiG43qjfmtq3Guw6sOC8EswLrShgPYc-1734174855-1.0.1.1-wonwuOC5.dmwgVALgQ7xIO5uL8mtLX2iVFiv8agCE0DkluCSZg6_z2WGomJY2XzSxaKEmpr.WGsnhDnSgquX5Q
info.zscaler.com/	1969-12-31 23:59:59	Name: BIGipServerabmweb-nginx-app_https Value: !hlcNmByC35OkgEJT1L58sRLd9whwRyWR4BvUCPgATHfy1X0t84ZvCrlUAvYS8UFlXaYt6BbNi/CXTw==
.zscaler.com/	1970-01-21 03:54:18	Name: _cq_duid Value: 1.1734174857.8el2N6GufhfCPquS
.zscaler.com/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1734174857.epjcYM360LrO1sJk
.www.zscaler.com/	1970-01-21 10:28:30	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sat+Dec+14+2024+03%3A14%3A17+GMT-0800+(Pacific+Standard+Time)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&consentId=4ac71297-833f-42a3-b51d-1d9e677f627e&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Finside-zloader-s-latest-trick-dns-tunneling&groups=C0004%3A0%2CC0001%3A1%2CC0005%3A0%2CC0002%3A0%2CC0003%3A0&hosts=H191%3A0%2CH36%3A1%2CH101%3A0%2CH152%3A0%2CH133%3A0%2CH8%3A0%2CH159%3A0%2CH104%3A0%2CH160%3A0%2CH105%3A0%2CH14%3A0%2CH149%3A0%2CH166%3A0%2CH17%3A0%2CH63%3A0%2CH174%3A0%2CH176%3A0%2CH177%3A0%2CH135%3A0%2CH179%3A0%2CH136%3A0%2CH182%3A0%2CH45%3A0%2CH33%3A0%2CH34%3A0%2CH187%3A0%2CH98%3A1%2CH141%3A1%2CH12%3A0%2CH76%3A0%2CH139%3A0%2CH110%3A0%2CH185%3A0%2CH190%3A0%2CH144%3A0%2CH68%3A0%2CH145%3A0%2CH31%3A0%2CH46%3A0&genVendors=
obs.iseaskies.com/	1970-01-21 09:46:45	Name: cg_uuid Value: 4921de541d455662e5beff90c7b36104
www.zscaler.com/	1970-01-21 11:18:54	Name: _gd_visitor Value: 1ad74790-dcc0-4e76-8226-b042f0010552
www.zscaler.com/	1970-01-21 01:43:09	Name: _gd_session Value: 83f2944b-9acc-4216-8ef3-cf75534aa713
.adnxs.com/	1970-01-21 11:18:54	Name: receive-cookie-deprecation Value: 1
.zscaler.com/	1970-01-21 11:18:54	Name: _ga_10SPJ4YJL9 Value: GS1.1.1734174857.1.0.1734174857.60.0.1752987186
www.zscaler.com/	1970-01-21 01:52:59	Name: _an_uid Value: 0
.zscaler.com/	1970-01-21 03:52:30	Name: _gcl_au Value: 1.1.1035420455.1734174858
.zscaler.com/	1970-01-21 01:44:21	Name: _uetsid Value: 8f4f57a0ba0c11ef91c657f1e85296df
.zscaler.com/	1970-01-21 11:04:30	Name: _uetvid Value: 8f4f9e00ba0c11efb0fb499d13cd06e8
.doubleclick.net/	1970-01-21 01:42:55	Name: test_cookie Value: CheckForPermission
.zscaler.com/	1970-01-21 03:52:30	Name: _fbp Value: fb.1.1734174857877.584887807886278050
.bat.bing.com/	1970-01-21 01:52:59	Name: MR Value: 0
.bing.com/	1970-01-21 11:04:30	Name: MUID Value: 06978AFB242769860AA29FAE25F16859
.zscaler.com/	1970-01-21 11:18:54	Name: _ga Value: GA1.2.1242532801.1734174858
.zscaler.com/	1970-01-21 01:44:21	Name: _gid Value: GA1.2.55905656.1734174858
.zscaler.com/	1970-01-21 01:42:54	Name: _gat_gtag_UA_6177009_1 Value: 1
.www.zscaler.com/	1970-01-21 10:28:30	Name: _zitok Value: 41acad8704fb7994af6c1734174858
.zoominfo.com/	1970-01-21 01:42:56	Name: __cf_bm Value: Xb2GVm1dftNo7izBlwvl.dRhkSOSB6QfKYg6l3_UrpM-1734174859-1.0.1.1-zegShZUIlmKHKfQm6DRKbBgxSp6aYDPn1DTSIgt4B1IDCerDB8ctn_pGgdbXpGESMvDOT1WPuaSwLrAGI6ZxzQ
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: pqnLfs3n6JGjJT2SD1kNnjsZLKUUhd6rDKzey6rZtKA-1734174859572-0.0.1.1-604800000

21 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.zscaler.com/blogs/security-research/inside-zloader-s-latest-trick-dns-tunneling Message: [GroupMarkerNotSet(crbug.com/242999)!:A0601D0044050000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
worker	verbose	URL: blob:https://www.zscaler.com/98c05d32-4e2a-4bc6-83c1-6d7e079e7813(Line 1) Message: Error
security	error	URL: https://www.googletagmanager.com/ Message: Refused to frame 'https://www.googletagmanager.com/' because it violates the following Content Security Policy directive: "frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com".
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').
security	warning	URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211&l=dataLayer&cx=c&gtm=45He4cc1v71607006za200(Line 456) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.googletagmanager.com') does not match the recipient window's origin ('null').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none'; img-src 'self' fast.wistia.com https: data: blob: https://.pathfactory.com https://explore.zscaler.com; script-src 'self' 'unsafe-inline' https://cdn.segment.com/analytics.js/v1/ https://js.zi-scripts.com/zi-tag.js https://ob.iseaskies.com https://obs.iseaskies.com .mountain.com https://netlify-rum.netlify.app j.6sc.co .adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net trk.techtarget.com t.sf14g.com .marketo.net js.adsrvr.org .crazyegg.com https://cdnjs.cloudflare.com https://.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com .bugcrowdusercontent.com .googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com .linkedin.oribi.io gateway.zscalertwo.net .jquery.com www.youtube.com https://js.zi-scripts.com https://ws-assets.zoominfo.com https://ws-assets.zoominfo.com 'unsafe-eval' https://api.intellimize.co https://cdn.intellimize.co https://www.clarity.ms/ https://ajax.googleapis.com/ https://cdn.rudderlabs.com/ https://.pathfactory.com https://explore.zscaler.com blob: ; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com https://.pathfactory.com https://explore.zscaler.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com https://.pathfactory.com https://explore.zscaler.com; connect-src 'self' blob: https://api.segment.io https://cdn.segment.com https://pixels.spotify.com/v1/ingest https://privacyportal.onetrust.com/request/v1/consentreceipts 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 35.83.209.52 44.238.33.223 54.190.217.118 44.240.152.58 54.69.255.140 52.88.179.26 34.238.149.65 52.7.151.245 44.209.137.118 35.81.173.170 34.210.219.79 52.37.218.4 52.42.124.195 52.89.99.220 35.85.106.161 44.235.191.156 52.12.117.226 35.81.162.201 34.212.4.35 https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io .cloudfunctions.net ibc-flow.techtarget.com .mktoresp.com bat.bing.com .crazyegg.com .6sc.co st.fullcircleinsights.com https://.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://.acsbapp.com https://.wistia.com https://.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com .6sense.com .linkedin.oribi.io https://adservice.google.com http://embed.wistia.com https://www.facebook.com/tr/ https://acsbapp.com/apps/app/dist/js/locale/en-loader.json https://js.zi-scripts.com https://ws.zoominfo.com https://log.intellimize.co https://api.intellimize.co ob.iseaskies.com obs.iseaskies.com https://t.clarity.ms/collect https://px.ads.linkedin.com/ https://api.rudderstack.com https://analytics.revsure.cloud https://.pathfactory.com https://explore.zscaler.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' blob: e.issuu.com insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://www.visualize-roi.com https://.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com https://zscalergov.my.site.com/ https://api.intellimize.co https://117186981.intellimizeio.com/ https://app.netlify.com/ https://.adroll.com/ https://explore.zscaler.com https://zscaler.my.site.com ; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com https://cms.zscaler.com https://zscalergov.my.site.com/ https://zscaler.pathfactory.com https://explore.zscaler.com https://zscaler.my.site.com;
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

117186981.intellimizeio.com
acsbapp.com
analytics.google.com
api.intellimize.co
b.6sc.co
bat.bing.com
c.6sc.co
cdn.cookielaw.org
cdn.intellimize.co
cms.zscaler.com
connect.facebook.net
eps.6sc.co
geolocation.onetrust.com
googleads.g.doubleclick.net
info.zscaler.com
ipv6.6sc.co
j.6sc.co
js.zi-scripts.com
log.intellimize.co
munchkin.marketo.net
ob.iseaskies.com
obs.iseaskies.com
secure.adnxs.com
stats.g.doubleclick.net
td.doubleclick.net
v.eps.6sc.co
ws-assets.zoominfo.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.zscaler.com
acsbapp.com
b.6sc.co
www.zscaler.com
104.17.72.206
151.101.66.132
172.253.122.155
172.64.150.44
2001:4860:4802:38::181
23.13.172.203
23.205.106.73
2600:1408:c400:d::17cd:6a49
2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
2600:9000:250a:9a00:c:d449:2a40:93a1
2606:4700:4400::6812:2215
2606:4700:4400::ac40:9b77
2606:4700::6810:752b
2606:4700::6810:762b
2606:4700::6812:572a
2607:f8b0:4004:c06::61
2607:f8b0:4004:c0b::9d
2607:f8b0:4004:c1b::9c
2607:f8b0:4004:c1d::93
2607:f8b0:400d:c00::64
2607:f8b0:400d:c02::5e
2607:f8b0:400d:c04::9d
2620:1ec:33::10
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
3.171.76.19
3.227.183.172
52.0.148.147
52.89.27.251
68.67.160.26
75.2.108.141
02cf967312da416498f662d891dd432426488424f6334da0eb277059ecd2f59b
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747
0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae
0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3
0e95b3816c967bdd21a6fd5b39e1a0d4190558ea29c3fc301df3cd049ee5b3a0
13c19ec8ecbdb0854e61b191ea4f6a9820760381bf6ce39d4e18193a4b808ca5
14135d774836383854e7b6bbe9405f82e33786fb0a4663970efaffbc7a59d33d
1ebb64cfb1007ee817bc11299a7a829dfe574d6a1ae4389056b23fbb7d0e1863
1fd41564413cfe94c87164c2a4902a573843f1e2367ddc93c62485d88b014b11
22ac63e88ac5429c4e81233b3bbd0209bc749a32fb112d1c90f174df52089d5e
2316eedc39d2ae71b2098be3e91ad3662cb1b70d42f6c61ebb6ab5beefd919b6
240355f4e85792fb5c1e46a942e6d797a078d39f8717dfbab666e4e80cb4dd8d
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
258ac87e304908a79116737170a587d0ea6cb91c9fa2e10389e0c52b3a30f2b0
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
270bfd677d1d3f2a708baf53c0cbb5f2909f601a585785c37cc62f44470853b1
27fdca9eafaee67c002005902aab15d2d51730420247b887550076c60bc55b63
2905d3d00589eb904d7eafb9d7fbae392cdf9c5f99ec54c4913797bea58705b4
29d106d265188e649c5573b599ed4aa1421b49cf320253d89fa43400c1941175
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
345877cdead5971b6dedd246401b2e833e02436e6abc4a254c8531b6cde639cd
3c417149b38800590986d283c74fe63b0f47f102c0f31fae6156f7b8e1b1d1d5
3f7b44e0bcec640ab0b2cb7f1c08dd2acd8537da4eb64f2c8e67ab5ab4250f30
416cb814af7408e0c40053f8834a1a0ff8343f5cb8607699f5ce4d29385d9df1
42717a207578018b81bd5bfb13fd41672e8081f2fa517e078b437c080885bb3c
446fcb4b09d3317056eaf5ea7de5e959d01a60de6a7bc39de340a3f3ba33e17e
46cba9639c8f0d177a80dd427f8b869b49f6b62193e2e781d8cc67be1782e61f
477029b64ea9a0f457b44c1d514c816624370cbddfaff93a2b90e36a52a5974e
4fb7c0200d46215e03c99a819b336c1426163575e3c55b6d5e9ba4449edede06
50d93a2c186cbd1032ed973e133713a6dfbbd5f7fba4fb89069350f228ce4d81
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
5367592d95c7be5bfd8852f1e69b88d4b32fa21a0e599ed493bb2e673dcae43f
543903cf053c0b027960d51a539f5e0e4b9597de2b7b80c79156d2ee78f5fe7b
54c0aeda81e2ecc27723f37c441e4530091780b93a1ca6d7a3d13a45e1ba4fa3
56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d
5a6b5937200edcb2aad4b81983c3fed49bf9ea80312843bb51435defabeba435
5c4f9af20d0e9e67c30c40d4fbb8f90ca63c28d56c68586906441b63095f0071
5ea21177acdf53bc6e55d2b43c3f662df111f3907eb497f732aeae9cb55b4330
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640
621212e2d47d4818dd10cf1e08011efdd647c40c409dcc708d856f5fd966846d
6487817342cc7311d0f8603168a7edba803aa7de8813673eb155e8ea8b77b32c
6524f78597d088f190890e00971f0b07e07433e704c449d09cf3aa7297d8c626
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b87b2d30bb74bfe1d30f849caa9318b5c9f2df4216324c4c91e5c301284a50e
7314898ae5841be613f65db4ba6b81d17e8a1e2a28cf11c40c0dbfcaa0a9859a
754a58487a0b52ac215f05028c3aebf5c50d4340c4f56686fa27e24a8a4382fc
761ffedd43b89b04bb84218b0a118a9719765dd3a058841973f2a071a64730b6
7b2a1e7ec66641ad958a36774552cc40712f052e2db6542cacc01fd2dbcde58c
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
7d7420dc00f6c2095845ed3099c8c38269d37ed054a8570135082f433b717ad7
7dc479230d1f930e663a76b0f7bca0ddfa9c553134b741283d2b9cf82323b9ff
7ea3d55a4fe561dd1479542608e0374371f86f94e589ccedc3910c415effc9a2
7ebe4c47a3c72f628aa1633221f01d98ec9549c6d1ea05034f30ec70f877fd2a
7f0b15a1afaad3090fcd15f3b85c16f3cd72b58498d099ceda1500749ba0e611
8228a5e160e09389114752fef88589847b2a2925c2ad447a2a0d1346a154feea
89d648c6aa4a3bbf08b974e37aef5d320c80e336ba365417c6285a2f2711b140
89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723
9154d414a27fae4611f3f046d25d022a22f4404d1cf169d8f27874d85e0fa2df
916031ed0f866bb0c4eedda4543b310d7aaba31e72f398ff5f110e64fbc607a9
92cad8f27e34bc081537b645a016152ce14c43f4d06870641fc63a34ed398445
939dd94ce46c2fc3503254f604250f1874490f419d4e67c6ceee53a2f16cf64f
946afb146fc270d96525d1c7470e1351af1551f9fe87637cc65ea9f2d0246d37
95574fc190611a6573178d07fb4e40ff98d224fb735648d76faafa20ae6dfbf4
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
997fddba8851c6cdf1a13ee986e9ffa6b750afc46ee4809b2642d1f70a496706
9d8415c5f1af85f7d369637172111e499c703136b8150cba9854a59dfe70e740
9dd93b89faa1f4642b0a4a84a36bccf5174c8af4a024d9291ed1e0300db58bcd
9f51ff024361e3d2d11964a55b9b1b54e89e911b4d60199aa0b55b8b5a214dcc
a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6
a59c1831b74b091c96a1938665c946f4a18a1294cc87867042d7ff5eebc34c79
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ad10b9a471d6c14afa1e652e147b8dac9e21ccca8269512f9e3ab6d21128eaed
ae9ce01eeaeb30d4044b4b309035579a53b0e534e28cbb8828f5b4f648514c10
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
b6315be78209cf808f242f765734bbd6c8dbc95b83285fe2bd2978311699d4ff
b7eff4b4361c8058fbe407d9e1e0e14f425df85f01cd295f6e1ac1271a3ff6bc
bad0b434fdb9b4c1996639fee84f05ed0aec4037eb51f40a56142878bcf4cd93
bb7aab905facf6c6fceee3cedfae6d685ec490a50103422a2726f92e117429e9
beac035e4d7e7ca8063a81be0994cfc994d5f1c7539091659834203e076476ac
c1580616e3616a775919fdab1a24b8c5d33dfa8f0e2c4265c0ab192a5bc59c6d
c1a5d90154c86803f67584209b4bd0385e51dd95e7b12a4e7cfa4e645dd72186
c35f6dd3b0ba20509d10536d6ecb201aa8e4ec53720402c566210f6fc5119770
c64ed9cbd4857f5cd7171a9f0f6fe9fe619ed237a243d01cda750c3e7b74d484
c7d91a422c4e10532fdffafa9d64a11dbbfdd0943736eb7cfff5652fa3921b56
c88c71934d2e43cf80d7e931804ecec7198178159a4c3888eec974ef26b18534
c96efc8ef4ae42bb64446649003f53e7bc981a095f07c6ec3807cfcb47039575
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca85d182af9fb895f4c9ac79ed8fdaf091eb3e1bca127ed880ae4ba5d82b60ab
cce2184ec089babc70ded47b8474c543f6a5ff013e4bfd9dbae8689489bb13ba
ce99852044b59bb736c57ef96bc2425a82ba6106f9301f9c310733f7fecfcbc1
d0ec04051c6114cc5c079a12d21ce695b45c0a1b0cb2d83886c26ee6cf1d187f
d55bb56299447bf3276bebf85f43c48b77d0e3bfdfbb6e4b278140d2ce971861
d5aaf7b9640925e4c588a8aa3a603f77889102f1b367db3becd44acbc5fe3ee5
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2
e6a1e90281fb5f6bd8c4df8697f16fdd66b968afe67e22f20130b2a212910ddb
eb39b08e053eaf04c0b9690265b21e3d8a6e5e834c59cb7c5ce37f0ccb0a0856
ee743f4334f5efe935a3448412258a387e91186b7b3ad237bd82f3061b24afa3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f34dcf4b0199f8e65fb814e549773b31ac54998d949e166432362f35e5cf4ece
f79f5f093b0603e16eb2ca2ac669545bba5eb6ed1155337799dbe1e203f6e27f
f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b
fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c
fd56cd9bfe6aeb270cbe6ba7f18e2e7d10101c34faca85d0eeda54fd37fcde24
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.zscaler.com Open in urlscan Pro 2606:4700:4400::6812:2215 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

153 Requests

95 %HTTPS

61 %IPv6

21 Domains

35 Subdomains

32 IPs

2 Countries

2784 kBTransfer

7456 kBSize

24 Cookies

30 Outgoing links

Redirected requests

153 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.zscaler.com Open in urlscan Pro
2606:4700:4400::6812:2215 Public Scan

Screenshot
Live screenshot

Full Image

153
Requests

95 %
HTTPS

61 %
IPv6

21
Domains

35
Subdomains

32
IPs

2
Countries

2784 kB
Transfer

7456 kB
Size

24
Cookies

153 HTTP transactions
2 data transactions