www.humansecurity.com Open in urlscan Pro
199.60.103.29 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-sc...
Submission: On October 30 via api (October 30th 2024, 2:08:43 pm UTC) from IN — Scanned from CA

Summary HTTP 138 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 52 IPs in 4 countries across 38 domains to perform 138 HTTP transactions. The main IP is 199.60.103.29, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.humansecurity.com.
TLS certificate: Issued by WE1 on September 5th 2024. Valid for: 3 months.

This is the only time www.humansecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
27	199.60.103.29 199.60.103.29	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
3	2607:f8b0:400... 2607:f8b0:4006:824::2008	15169 (GOOGLE) (GOOGLE)
9	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:141b:1c0... 2600:141b:1c00:6::17df:d14d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6811:ac5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c1b::5f	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:33:2... 2620:1ec:33:2::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	142.251.40.132 142.251.40.132	15169 (GOOGLE) (GOOGLE)
2	142.250.65.162 142.250.65.162	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80a::200e	15169 (GOOGLE) (GOOGLE)
1	2600:141b:1c0... 2600:141b:1c00:6::17df:d145	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	108.138.106.101 108.138.106.101	16509 (AMAZON-02) (AMAZON-02)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	142.251.40.163 142.251.40.163	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:1eb0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	23.204.6.193 23.204.6.193	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2600:141b:1c0... 2600:141b:1c00:30::1739:5a6c	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	54.146.148.156 54.146.148.156	14618 (AMAZON-AES) (AMAZON-AES)
1	52.85.61.60 52.85.61.60	16509 (AMAZON-02) (AMAZON-02)
2	31.13.80.12 31.13.80.12	32934 (FACEBOOK) (FACEBOOK)
2	151.101.44.157 151.101.44.157	54113 (FASTLY) (FASTLY)
3	2606:4700:440... 2606:4700:4400::ac40:9310	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8d11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.164.96.87 18.164.96.87	16509 (AMAZON-02) (AMAZON-02)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2607:f8b0:400... 2607:f8b0:4004:c09::9b	15169 (GOOGLE) (GOOGLE)
1	54.91.78.159 54.91.78.159	14618 (AMAZON-AES) (AMAZON-AES)
3	142.250.80.78 142.250.80.78	15169 (GOOGLE) (GOOGLE)
2	142.251.32.99 142.251.32.99	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
1	13.226.94.10 13.226.94.10	16509 (AMAZON-02) (AMAZON-02)
1	13.226.34.79 13.226.34.79	16509 (AMAZON-02) (AMAZON-02)
2	34.107.199.61 34.107.199.61	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9	35.190.10.96 35.190.10.96	15169 (GOOGLE) (GOOGLE)
1	104.16.118.43 104.16.118.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	104.16.117.43 104.16.117.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
2	142.251.41.8 142.251.41.8	15169 (GOOGLE) (GOOGLE)
1	2600:9000:251... 2600:9000:2511:1a00:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	63.33.121.64 63.33.121.64	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:80d::200e	15169 (GOOGLE) (GOOGLE)
5	104.18.89.62 104.18.89.62	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:28b... 2600:9000:28b2:7000:9:14eb:6280:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::ac43:b9b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.164.96.18 18.164.96.18	16509 (AMAZON-02) (AMAZON-02)
138	52

27 199.60.103.29 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.humansecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:824::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:6::17df:d14d (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:ac5b (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1b::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:2::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.132 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.162 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80a::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:6::17df:d145 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.106.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-101.jfk50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.251.40.163 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1eb0 (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.204.6.193 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-204-6-193.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:141b:1c00:30::1739:5a6c (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

client.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.146.148.156 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-148-156.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.61.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-60.ewr53.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.80.12 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-yyz1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.44.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::ac40:9310 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8d11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:820::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.164.96.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-87.jfk50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c09::9b (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.91.78.159 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-91-78-159.compute-1.amazonaws.com

s.cdnsynd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.80.78 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.32.99 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f3.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.94.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-94-10.jfk52.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.34.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-34-79.ewr53.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.199.61 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 61.199.107.34.bc.googleusercontent.com

stk.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 35.190.10.96 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 96.10.190.35.bc.googleusercontent.com

collector-pxf69i9fy8.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
collector-pxxdhgmtcm.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.118.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.16.117.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

001-vjx-104.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.41.8 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2511:1a00:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.33.121.64 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-121-64.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80d::200e (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.18.89.62 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:28b2:7000:9:14eb:6280:93a1 (United States)

ASN16509 (AMAZON-02, US)

d2i34c80a0ftze.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:b9b (United States)

ASN13335 (CLOUDFLARENET, US)

acsbapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.164.96.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-18.jfk50.r.cloudfront.net

st.fullcircleinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	humansecurity.com www.humansecurity.com	441 KB
14	px-cloud.net client.px-cloud.net — Cisco Umbrella Rank: 4419 stk.px-cloud.net — Cisco Umbrella Rank: 21462 collector-pxf69i9fy8.px-cloud.net collector-pxxdhgmtcm.px-cloud.net	144 KB
9	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	248 KB
6	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 td.doubleclick.net — Cisco Umbrella Rank: 192 stats.g.doubleclick.net — Cisco Umbrella Rank: 136	3 KB
5	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 8959	62 KB
5	zoominfo.com ws-assets.zoominfo.com — Cisco Umbrella Rank: 11155 ws.zoominfo.com — Cisco Umbrella Rank: 4482	33 KB
5	gstatic.com fonts.gstatic.com	105 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34	22 KB
5	linkedin.com 1 redirects platform.linkedin.com — Cisco Umbrella Rank: 3841 px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	163 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	428 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579	10 KB
3	company-target.com s.company-target.com — Cisco Umbrella Rank: 1520 segments.company-target.com — Cisco Umbrella Rank: 1534 api.company-target.com — Cisco Umbrella Rank: 4087	1 KB
3	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2172	19 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5671	4 KB
3	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 147	88 B
3	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
2	fullcircleinsights.com st.fullcircleinsights.com — Cisco Umbrella Rank: 111989	2 KB
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 812	771 B
2	google.ca www.google.ca — Cisco Umbrella Rank: 12143	127 B
2	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 5859 track.hubspot.com — Cisco Umbrella Rank: 2324	2 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1472	27 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	83 KB
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 5931 tag-logger.demandbase.com — Cisco Umbrella Rank: 5266	18 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3657	7 KB
2	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8252	2 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 877 script.hotjar.com — Cisco Umbrella Rank: 1177	61 KB
1	acsbapp.com acsbapp.com — Cisco Umbrella Rank: 3740 cdn.acsbapp.com Failed	115 KB
1	cloudfront.net d2i34c80a0ftze.cloudfront.net	11 KB
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 6755	171 B
1	mktoresp.com 001-vjx-104.mktoresp.com	318 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	305 B
1	cdnsynd.com s.cdnsynd.com — Cisco Umbrella Rank: 10661	64 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2191	25 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5740	92 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	28 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 5807	5 KB
138	38

	Domain	Requested by
27	www.humansecurity.com	www.humansecurity.com cdn2.hubspot.net
9	cdn.cookielaw.org	www.humansecurity.com cdn.cookielaw.org client.px-cloud.net
5	cdn2.hubspot.net	cdn2.hubspot.net www.humansecurity.com
5	collector-pxxdhgmtcm.px-cloud.net	client.px-cloud.net
5	fonts.gstatic.com	fonts.googleapis.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com client.px-cloud.net
5	www.googletagmanager.com	www.humansecurity.com www.googletagmanager.com www.google-analytics.com
4	ws.zoominfo.com	client.px-cloud.net
4	collector-pxf69i9fy8.px-cloud.net	client.px-cloud.net
4	tags.srv.stackadapt.com	www.humansecurity.com tags.srv.stackadapt.com
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	js.hs-banner.com	www.humansecurity.com js.hs-banner.com
3	client.px-cloud.net	www.googletagmanager.com www.humansecurity.com client.px-cloud.net
3	js.zi-scripts.com	www.humansecurity.com js.zi-scripts.com
3	bat.bing.com	www.humansecurity.com bat.bing.com
2	st.fullcircleinsights.com	d2i34c80a0ftze.cloudfront.net
2	stk.px-cloud.net	client.px-cloud.net
2	id.rlcdn.com	2 redirects
2	www.google.ca	www.humansecurity.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	td.doubleclick.net	www.googletagmanager.com
2	platform.twitter.com	www.humansecurity.com platform.twitter.com
2	connect.facebook.net	www.humansecurity.com connect.facebook.net
2	munchkin.marketo.net	www.humansecurity.com munchkin.marketo.net
2	tracking.g2crowd.com	www.humansecurity.com tracking.g2crowd.com
2	googleads.g.doubleclick.net	www.humansecurity.com www.googletagmanager.com
2	www.google.com	1 redirects www.humansecurity.com
1	acsbapp.com	www.humansecurity.com
1	d2i34c80a0ftze.cloudfront.net	www.humansecurity.com
1	track.hubspot.com
1	analytics.google.com	client.px-cloud.net
1	content.hotjar.io	script.hotjar.com
1	tag-logger.demandbase.com	tag.demandbase.com
1	001-vjx-104.mktoresp.com	munchkin.marketo.net
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	api.company-target.com	tag.demandbase.com
1	segments.company-target.com	www.humansecurity.com
1	s.company-target.com	tag.demandbase.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	s.cdnsynd.com	www.googletagmanager.com
1	px4.ads.linkedin.com	www.humansecurity.com
1	script.hotjar.com	static.hotjar.com
1	app.hubspot.com	www.humansecurity.com
1	js.hs-analytics.net	www.humansecurity.com
1	js.hsleadflows.net	www.humansecurity.com
1	tag.demandbase.com	www.humansecurity.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	fonts.googleapis.com	www.humansecurity.com
1	cdnjs.cloudflare.com	www.humansecurity.com
1	static.hsappstatic.net	www.humansecurity.com
1	platform.linkedin.com	www.humansecurity.com
0	cdn.acsbapp.com Failed	client.px-cloud.net
138	53

This site contains links to these domains. Also see Links.

Domain
docs.humansecurity.com
partners.humansecurity.com
www.facebook.com
twitter.com
www.linkedin.com
github.com
www.cisecurity.org
linkedin.com
t.me
support.humansecurity.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
www.humansecurity.com WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2024-03-29` - `2025-03-28`	a year	crt.sh
hsappstatic.net WE1	`2024-09-06` - `2024-12-05`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
zi-scripts.com WE1	`2024-09-22` - `2024-12-21`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
g2crowd.com WE1	`2024-10-19` - `2025-01-17`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
client.botchk.net R11	`2024-09-24` - `2024-12-23`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M03	`2024-08-09` - `2025-09-06`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-27` - `2025-09-28`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-08` - `2024-11-06`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-24` - `2025-07-25`	a year	crt.sh
hs-banner.com WE1	`2024-09-24` - `2024-12-23`	3 months	crt.sh
hsleadflows.net WE1	`2024-09-29` - `2024-12-28`	3 months	crt.sh
hs-analytics.net WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
hubspot.com WE1	`2024-10-03` - `2025-01-01`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
cdnsynd.com E6	`2024-09-25` - `2024-12-24`	3 months	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.google.ca WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
*.company-target.com R10	`2024-10-14` - `2025-01-12`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-13` - `2025-09-14`	a year	crt.sh
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA	`2024-08-16` - `2025-09-15`	a year	crt.sh
zoominfo.com E5	`2024-10-12` - `2025-01-10`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
*.demandbase.com Amazon RSA 2048 M02	`2024-06-10` - `2025-07-08`	a year	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
hubspot.net WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
acsbapp.com WE1	`2024-10-16` - `2025-01-14`	3 months	crt.sh
aws-st.fullcircleinsights.com Amazon RSA 2048 M02	`2024-05-28` - `2025-06-25`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Frame ID: 5EED76B6F7E918ADE564FE9F5D915A04
Requests: 130 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.humansecurity.com
Frame ID: 45DAEAB18ED4F4C36DB7C413B3F37A0E
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/878225418?random=1730297314628&cv=11&fst=1730297314628&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9102558839z8830094232za201zb830094232&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&hn=www.googleadservices.com&frm=0&tiba=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&npa=0&pscdl=noapi&auid=1303771909.1730297314&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: CDFA47C3EA258FD16253C181E9CA36E5
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: 7AFEF55B31AD0B9EEB4AC37BD26F8131
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.humansecurity.com
Frame ID: DC9F112A6DB31A0FB720938BDAB6C3B0
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-59DHKRCY6M&gacid=GA1.2.1371297405.1730297315&gtm=45je4as0v881684866z8830094232za200zb830094232&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629&z=2038698820
Frame ID: E9B9CD927A704FD075A48E4E2EFCB2E4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Satori Threat Intelligence Alert: Konfety Spreads ‘Evil Twin’ Apps for Multiple Fraud Schemes

Detected technologies

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Lightbox (JavaScript Libraries) Expand

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css
owl\.carousel.*\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

138
Requests

94 %
HTTPS

42 %
IPv6

38
Domains

53
Subdomains

52
IPs

4
Countries

2201 kB
Transfer

6350 kB
Size

55
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://docs.humansecurity.com/
Title: Documentation Details about HUMAN's products and interfaces.

Search URL Search Domain Scan URL

URL: https://partners.humansecurity.com/English/?ReturnUrl=%2fEnglish%2fPartners%2fhome.aspx
Title: Partner Portal Log into the HUMAN Partner Portal for collateral, documentation, and other partnership needs.

Search URL Search Domain Scan URL

URL: https://www.facebook.com/secure_with_human
Title: This is a title This is a subtitle Some content goes here..

Search URL Search Domain Scan URL

URL: https://twitter.com/SecureWithHUMAN
Title: This is a title This is a subtitle Some content goes here..

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/humansecurityinc/
Title: This is a title This is a subtitle Some content goes here..

Search URL Search Domain Scan URL

URL: https://docs.humansecurity.com/media-security/ivt-taxonomy
Title: IVT Taxonomy

Search URL Search Domain Scan URL

URL: https://github.com/CaramelAds
Title: GitHub

Search URL Search Domain Scan URL

URL: https://www.cisecurity.org/ms-isac/services/words-of-estimative-probability-analytic-confidences-and-structured-analytic-techniques
Title: high confidence

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Social%20Share%20Buttons&url=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://linkedin.com/shareArticle?mini=true&title=Social%20Share%20Buttons&url=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://t.me/share?url=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Search URL Search Domain Scan URL

URL: https://partners.humansecurity.com/English/?ReturnUrl=%2fEnglish%2fPartners%2fhome.aspx&__hstc=233546881.7f9124919ef436acf331cc4180a46d72.1635342799936.1648671054706.1648675289816.112&__hssc=233546881.12.1648738104896&__hsfp=1741684099
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://support.humansecurity.com/hc/en-us
Title: Docs

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/humansecurityinc

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31

https://www.google.com/pagead/landing?gcs=G1--&gcd=13l3l3l3l5l1&tag_exp=101533422~101823848~101878899~101878944~101925629&rnd=627229214.1730297314&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&dma=0&npa=0&gtm=45He4as0n81KVP42DDv830094232za200&auid=1303771909.1730297314&apve=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5l1&tag_exp=101533422~101823848~101878899~101878944~101925629&rnd=627229214.1730297314&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&dma=0&npa=0&gtm=45He4as0n81KVP42DDv830094232za200&auid=1303771909.1730297314&apve=0

Request Chain 70

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730297315264&li_adsId=d3a23c2a-07a1-42cd-af43-b83f2ff6abfe&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730297315264&li_adsId=d3a23c2a-07a1-42cd-af43-b83f2ff6abfe&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2&e_ipv6=AQJw9hitUGaEAwAAAZLdwcF3CfR5ed4ui4iaBGBPeemZyb_2B_1EM99DIC6DlezIuchI3jRz

Request Chain 80

https://id.rlcdn.com/464526.gif HTTP 307
https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCOP7iLkGEgUI6AcQAEIASgA HTTP 307
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297s7JTH6MeeajvaG_V012JSDJZAFWCuzFeXGrYi-VZWVo

138 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes Show response
www.humansecurity.com/learn/blog/ 261 KB
40 KB 545ms
304ms Document
text/html 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc134f4dbeede81af4991e9d11a713f7d0620e5d2e80311d1dbb0e51cf8cbbc6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: false
alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=7200,max-age=5
cache-tag: CT-172757353219,CT-32703345508,CT-34074471138,CT-35748658419,CG-5249379964,P-3400937,CW-120410438969,CW-123754977913,CW-166526026759,CW-63656548895,CW-63656638135,CW-63656840557,CW-64556607012,E-115294898870,E-115307132989,E-115307516677,E-115387395449,E-115388248694,E-115450692019,E-115451707707,E-120377909830,E-164610244707,E-164611792452,E-164742850616,E-164742903989,E-166527373913,E-166942765475,E-63463820289,E-63463820290,E-63463820292,E-63463820302,E-63656499996,E-63656586570,E-63656625716,E-63656674711,E-63656841263,E-63656841264,E-68518573488,E-91065958246,E-91065964034,E-99901597287,RA-170315478827,RA-171495719182,RA-172012720271,RA-174301124992,PGS-ALL,SW-3,GC-166536734550,GC-166958618433,TS-63463820311
cf-cache-status: HIT
cf-ray: 8dabfa59993ba1ff-YYZ
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html;charset=utf-8
date: Wed, 30 Oct 2024 14:08:32 GMT
edge-cache-tag: CT-172757353219,CT-32703345508,CT-34074471138,CT-35748658419,CG-5249379964,P-3400937,CW-120410438969,CW-123754977913,CW-166526026759,CW-63656548895,CW-63656638135,CW-63656840557,CW-64556607012,E-115294898870,E-115307132989,E-115307516677,E-115387395449,E-115388248694,E-115450692019,E-115451707707,E-120377909830,E-164610244707,E-164611792452,E-164742850616,E-164742903989,E-166527373913,E-166942765475,E-63463820289,E-63463820290,E-63463820292,E-63463820302,E-63656499996,E-63656586570,E-63656625716,E-63656674711,E-63656841263,E-63656841264,E-68518573488,E-91065958246,E-91065964034,E-99901597287,RA-170315478827,RA-171495719182,RA-172012720271,RA-174301124992,PGS-ALL,SW-3,GC-166536734550,GC-166958618433,TS-63463820311
last-modified: Wed, 30 Oct 2024 14:01:27 GMT
link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SOgjmC3zzzNR8yGjAZZQCbujUI4LnneU9jXzXOBS7iLnICTQ%2F1c0eszcz9aGK2EtkqogEk%2FrQhPzAOkCO3SVijbqGmmYrGgHr0AYA3K0Emy%2BDwvcgPp1NA9sSnIxhGKSocQU62cFVA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: origin, Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 926
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/cms-sl-td/envoy-proxy-5bcf5dc485-87rsz
x-evy-trace-virtual-host: all
x-hs-cache-config: BrowserCache-5s-EdgeCache-7200s
x-hs-content-id: 172757353219
x-hs-hub-id: 3400937
x-hubspot-correlation-id: bbe3bcc9-33c5-440f-ad24-7bf30bd3578a
x-request-id: bbe3bcc9-33c5-440f-ad24-7bf30bd3578a

GET
H3 200 project.js Show response
www.humansecurity.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 150ms
131ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"61ca66de658cab9587e4636894680d5d"
age: 596910
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bmtaV4tiDeZ9yAvIFhXac%2FTX%2B0QjejnC%2Ff2oxjmflNM6qQXNUUtcThHTSFBJiDcBudu1%2FU1m%2F7%2FOSn2No1q8FCPFijmrf6QXMpRiDBi60pa%2FKYniQ%2BZq1p91rf46WVVofybrAIj7VA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Thu, 30 Oct 2025 14:08:32 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: aXBK5u8CJmbOPISqQy85PWyi75fbjTpWsfzweyEajbrOtXCka2Ey5A==
date: Wed, 30 Oct 2024 14:08:32 GMT
content-type: application/javascript
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 43334f58904cd7106ee523ee0361b402.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb56a1ff-YYZ
x-amz-cf-pop: YUL62-C2
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 frontend.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656586570/1698698464930/humansecurity-hs/punch/assets/css/ 43 KB
9 KB 103ms
89ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656586570/1698698464930/humansecurity-hs/punch/assets/css/frontend.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

afff892691aaab5f3a2c411cb09a2674006120f314eb8ac1fc6efb8c66a1c353

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 19768380-3d8b-4d93-a010-29c1b8b8eb41
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b77d3abc0b9bf83fbcfd36a5a1e3ea4c"
age: 2010
x-amz-version-id: GaNibL_2mws_6v_lkcwwJfeo4CxpHPWp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qjScLPZbOU%2B3IE43Iv6UrhjIdLHnZvhU0ucezSY9ToT4JAF32GPA5utcqxWhCgjtX0PXbbk8HXb7FNtg4VG6a767Wo5XrpEFYh%2FkdnEUG%2FYpvIqp5N017rXpx3LZrkmXQrjqNZL0ww%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: C0hdkr-0JYKASUVHfgdb81-eOD7YSHHNFe27ZwDmHrBDYkSGGPL_RA==
x-hubspot-correlation-id: 19768380-3d8b-4d93-a010-29c1b8b8eb41
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:41:06 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-4hrwm
x-envoy-upstream-service-time: 198
x-amz-request-id: E20GYQ7G57JPMETE
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: HRrfUmrNlZnYH6fIw8hgoP2BOlaWnZ/KZloJ6hutI/b7Uf9jzuF5mPQswSpf5FSFKfpYBaX+6DI=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 b0785dd15b9c7ed21cde8fa5e473d0a2.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb5aa1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1698698465825

GET
H3 200 variables.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820290/1693233181263/humansecurity-hs/assets/css/dist/ 0
1 KB 142ms
128ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820290/1693233181263/humansecurity-hs/assets/css/dist/variables.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: c5e47e35-fbe0-4d9d-b700-472066e10019
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 2010
x-amz-version-id: PVtlsZaAUzw31xbOkIyAmX4R8T95ZDvv
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NhBuWTrvQh3pP4VPZwAqqE4EOfXpX2XqqX9P53AJgWiOUUh5h4LNmWK7MS6TiM13QAfMjPc2S1JtU7vOv7zc5%2BrXG5Heub%2B2y45fhOTHcXYUxRvUa5bXg6k%2BMo9ZFGPWMaS60BQlbA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: Cx-TYhN3GwAKO6fcb9ZejJpDoRZwPq__Kt5W5CqL46-ja9rX4Xvi_g==
x-hubspot-correlation-id: c5e47e35-fbe0-4d9d-b700-472066e10019
content-type: text/css
last-modified: Mon, 28 Aug 2023 14:33:02 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-x5qbk
x-envoy-upstream-service-time: 193
x-amz-request-id: 8HR5K6H3YVDQ5FQP
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
content-length: 0
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: vf/Et3tfFrKDN+qRHL9tRh5hptpMYr83x+RpN4OEGWyMZH5vFWChdOXW7kiwryF8c+m5wZj34L42Vd+tFY7jMbnmyT3UNdlqlYF3JZ1Yb14=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb5ea1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1693233181849

GET
H3 200 main.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/ 79 KB
22 KB 102ms
88ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/main.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0392294081a8113d3c077796594484f5354ebb23b518d3337738015bddb70aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: e114411b-e363-421c-bd5c-125d79879f3d
content-encoding: gzip
cf-cache-status: HIT
etag: W/"47787750df632993e786b00ce189b343"
age: 2010
x-amz-version-id: SAEe3SNv3Lb1_ysCcV6bfhvdbJ82X__.
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fGumNXC4R5dkN3%2BXjaxgtPKLZwuuiq0IRqRoZigTJBaslPPs1vvYtnFkaTaVCV%2F6Ujf4zlb2%2Bgj53UuAKWA3hBYvD5o94R8vHfiK65jYQHLogz4rO6WnSX4pNnJ%2FQ24qbitbwwATpA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: cCRKj1H8_r23LDNMn8LhZvcM8htVA3U4FONB7fKEKPiKoPYxoPRCng==
x-hubspot-correlation-id: e114411b-e363-421c-bd5c-125d79879f3d
content-type: text/css
last-modified: Wed, 15 May 2024 15:29:50 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-sf8l8
x-envoy-upstream-service-time: 302
x-amz-request-id: TVCZ7PRD5QJ65HC6
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: ykl2YNNFGc2Gt3f0Cx/2hXVSq84HSWWudF7z8S2xv3t4XzYzSpWNLm4nolDpQTVZilZ0/d49igk=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb60a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1715786989545

GET
H3 200 single-common.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/ 16 KB
4 KB 141ms
127ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/single-common.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

81f2e0a9e0cbb9cfcb5d72f56f4eff056370ddd14104251fc7066a8f7d641828

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: b605937f-fb07-47df-91c6-5378e04ab44c
content-encoding: gzip
cf-cache-status: HIT
etag: W/"49aab6c32e04790c0f1e45fad3996b2b"
x-amz-version-id: TDjcu_c8CPezB1bGaaBBUci0M.U7cgii
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dQA7hNErzpZMboNQrZnJyUPpheMQSrvEl9FwenUzdFvrasplJ6AwBzfNQWaeNNqf%2FOL29UhA9ULnPJ5mEJHur6%2BEXBZjKQRSAIQ2PN%2FnmNN5yV6w1VvbzZgmwRA12ddixc1z979L0A%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: -ym0MOaytaKOkhK1jd6pfyCsnDNo5260dvMSfgQpNTGtipSb-xhChw==
x-hubspot-correlation-id: b605937f-fb07-47df-91c6-5378e04ab44c
content-type: text/css
last-modified: Wed, 06 Mar 2024 19:23:23 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54bddf99d6-bsggk
x-envoy-upstream-service-time: 226
x-amz-request-id: ESE6N64TX8J969XD
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: NaeqkMw+9kFnJjv6dtEDHu3JeUuiwi/RoPjvGT2b7HaRtd0/SU3xnBF8UwLzLtGME7pQvwFdxJA=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb64a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1709753002890

GET
H3 200 module_166526026759_header-menu-v2.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/module_assets/166526026759/1716224039145/ 843 B
2 KB 143ms
127ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/module_assets/166526026759/1716224039145/module_166526026759_header-menu-v2.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f684971a6600c115bd3d3102c43a0b09ad5a1a3c45a818269445ba888ce8d58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 5154eddd-c521-41ac-ab16-8e2ab446cf98
content-encoding: br
cf-cache-status: HIT
etag: W/"6805cf8d57acac50bb55afbe7921aa0e"
age: 2010
x-amz-version-id: BzbKtMItj7hwZxg5bjmqXnlAHwZPHzBN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fm4YdX7j%2FhDfzjPrBEGrO116WHdXYX0DJ99ISDjyINnKxpDeBIpCGbYr9b6ilWbO4jeGJKDHA4gp8vPjn3tvdN2OWG676dlsFVsamqxLG7MNnLJgA1b%2FNcuEZpdLD8%2FzhaR7nh%2F7VA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: 3vNLnwPi3YGTbs7ObNsQljQtJtoy9UDvDo39sobAKonwil5MBjSxAg==
x-hubspot-correlation-id: 5154eddd-c521-41ac-ab16-8e2ab446cf98
content-type: text/css
last-modified: Mon, 20 May 2024 16:54:00 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54797cf595-kpdsh
x-envoy-upstream-service-time: 289
x-amz-request-id: M1GES83Z327TGD7H
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: +Af0VjFkS/E0zuMi7gHVLzR4LVjYVawDeURulFxwCegbNGgIVTICpBNTjTjvW0x1BUaRbrdpAYA=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb67a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1716224039145

GET
H3 200 owl.carousel.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742903989/1713364613685/humansecurity-hs/assets/js/owlcarousel/assets/ 3 KB
2 KB 140ms
124ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742903989/1713364613685/humansecurity-hs/assets/js/owlcarousel/assets/owl.carousel.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: bd43132e-5001-4074-9691-5ffa900eb7be
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b2752a850d44f50036628eeaef3bfcfa"
age: 2010
x-amz-version-id: lxA_FGpWvDSJaDwG1OPwtR8dnfjYrFcp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NntfUOKM9NgaoRwym%2BRMp6EqPUF2ReTkczhWSuoMu%2BZ4a83Dg9yPEUKfKWUkiDr%2BSrsnL4cHNPuDSlwcue4OWZHKql6l7vOHPLFhR%2Bzq8RoQlEzc1JKu0Oe2zRchg86PoUjnYID7SQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: kSaUg9liQHgJPPGezORA9RB0lXzYwHX5YwEIziXqaArJCxek8_wTng==
x-hubspot-correlation-id: bd43132e-5001-4074-9691-5ffa900eb7be
content-type: text/css
last-modified: Wed, 17 Apr 2024 14:36:54 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-q9n7k
x-envoy-upstream-service-time: 188
x-amz-request-id: ZDKQ86CAW0JJ9J2M
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: fD4tX1eq/0OgofFFVSzelWFJxTOCgfcIsj0eCRAOAiywPCx3Bgt0QKi3BUZtlb78czhbaYgrEco=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 5084a25d91022b55b5acf281581c6444.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb6aa1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1713364613685

GET
H3 200 human.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164611792452/1730277209957/humansecurity-hs/assets/css/dist/ 63 KB
16 KB 140ms
125ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164611792452/1730277209957/humansecurity-hs/assets/css/dist/human.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd762e49a4607a3c0fdaa62f8becc923fbff15e1c0053fe12783b9ea8a6c9afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 098f88d9-e705-4e06-a69c-986100843652
content-encoding: gzip
cf-cache-status: HIT
etag: W/"54507225231827f4136e81ce4aa1c88a"
age: 89
x-amz-version-id: F8rGuwUpqUqrrOfr2MpQggqfja6siPoh
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pHxs%2F9E3naqa%2FZJLwclcz9OV%2BpfL0BtJiZYirU0MHVQk1d7uHaR4FvhSVcQ1fcqFsEsfZQmSflIk%2FmkfdfQGxtXNamGiYqseInVXtd5J2wF0XzwMrfyOEf%2FFnfserVCJvL9MGIx%2FzA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: AHg4oAAgThY61nB3k_j4nei5Eltkw5UbIKZJzS_mRyZ3Ap6OpjTbyQ==
x-hubspot-correlation-id: 098f88d9-e705-4e06-a69c-986100843652
content-type: text/css
last-modified: Wed, 30 Oct 2024 08:33:32 GMT
x-amz-replication-status: PENDING
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-q48r7
x-envoy-upstream-service-time: 140
x-amz-request-id: 8SWJ8ZD0X6YV1WWG
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: uOLXsB/fQKBwye7EGuwk5jafH8TtXML07EqvuAcC79hCSjxpXELoseXaiB6CLRIEmV22CZZdL+E=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 85fc1201a1918facbeb30836e7391660.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb6fa1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1730277211202

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 383 KB
123 KB 615ms
85ms Script
application/javascript 2607:f8b0:4006:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

461fa495106ada93686b3be60ebce7be7199d7cc646970cbb3643982bf42e989

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Wed, 30 Oct 2024 14:08:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 30 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 125053
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 1070ms
76ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: qVqAwzZMp5y69q24H0KNhg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCF832FB5A8B8E
x-ms-lease-status: unlocked
age: 7527
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 12:03:07 GMT
date: Wed, 30 Oct 2024 14:08:34 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 16:01:42 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ea261024-a01e-0045-1c1e-2a4e1b000000
cf-ray: 8dabfa685faca304-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7212
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 prism.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065964034/1693233180291/humansecurity-hs/assets/css/dist/ 1 KB
2 KB 140ms
125ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065964034/1693233180291/humansecurity-hs/assets/css/dist/prism.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b17ad6eab5f71934277721a0558d12da27ef1c1d7688d3dc8e8440165902526b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a2d954e9-75ea-4a68-9d01-0f823f476e7a
content-encoding: gzip
cf-cache-status: HIT
etag: W/"9f0794436f73e871f1d234b0aed34aaf"
x-amz-version-id: 4AdoQ1qbFlghg5XDq_6m5FKyZgIg_9_9
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sjREg2GU3Vg44RU1DAEqz5KlAdyn3pY9ihK1qQNnv5OM6FeiWq4vEVOSG9mD3eh76ybRwoTT3yczsAuiBZW9o5WL6t1MNXsDR5r9B%2F%2FoLGlyRSBenYYrk09z10gibSjROCOgpB7evQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: N2dLL7TVUZuHy7f4Kml8Yy7BFULIiIJEIjaybgR9sqKirYvKzqrlXQ==
x-hubspot-correlation-id: a2d954e9-75ea-4a68-9d01-0f823f476e7a
content-type: text/css
last-modified: Mon, 28 Aug 2023 14:33:01 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-n6klc
x-envoy-upstream-service-time: 218
x-amz-request-id: KQ17GH5RDBGTNTPP
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: LkQOceY9aYljJN6AS3owVWACsrL66a1gHgy9GS00qcKCS4tZROHy/zufPHXpAwJXesbQ1ajWP4s=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 52ac015dacdf6aed9db953cf96e66dda.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb73a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P3
x-amz-meta-created-unix-time-millis: 1693233180994

GET
H2 200 in.js Show response
platform.linkedin.com/ 510 KB
160 KB 411ms
27ms Script
text/javascript 2600:141b:1c00:6::17df:d14d
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:6::17df:d14d Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Play /

Resource Hash

5b4134fc9963276fb840bb8178d62e95d0efa733909f6eeef3f364d4d60f0777

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-li-pop: prod-lva1-x
cache-control: public, max-age=3600
content-encoding: gzip
x-cdn: AKAM
x-li-fabric: prod-lva1
x-content-type-options: nosniff
expires: Wed, 30 Oct 2024 14:27:27 GMT
x-li-uuid: AAYlsam46TcSjXQq7f/X7Q==
x-li-proto: http/1.1
content-length: 163630
date: Wed, 30 Oct 2024 14:08:32 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
server: Play
x-cdn-client-ip-version: IPV6

GET
H3 200 js.cookie-min.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/120377909830/1693233183213/humansecurity-hs/assets/js/dist/ 2 KB
2 KB 139ms
125ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/120377909830/1693233183213/humansecurity-hs/assets/js/dist/js.cookie-min.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9cac5e10bd3d5631c178a838d415c28b126daca61e10e81e6dc36aa18919174f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: b2e46002-fe53-4da8-9d5a-5a3cd51f853a
content-encoding: br
cf-cache-status: HIT
etag: W/"b2d77f293176c0278a1d65d5afe1d1b9"
age: 2010
x-amz-version-id: LVKDx31g5hiRxJMSIPYCqKTZgOeBIIto
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YA6co7RI8eon%2BTN8M9gdF8r%2F4%2FKRMpq64f6oq8QeKGW18afraXHFw7pk%2BtrjKW9%2FAAtPRoCUtV8bmqOefpE4q0FBll0BpV6mx4Di8Wd3c2FVauD%2FAzJ0rNLzUtEHncD8PfvcLiFZyg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: Rh5VwVvQgakTZxIzARgOD9bjXNMsI_p9EG9fC2N1tF9MD-DQFGiUgw==
x-hubspot-correlation-id: b2e46002-fe53-4da8-9d5a-5a3cd51f853a
content-type: application/javascript; charset=utf-8
last-modified: Mon, 28 Aug 2023 14:33:04 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-54797cf595-dzw6q
x-envoy-upstream-service-time: 150
x-amz-request-id: 4XEMZT0SWHHPY8DX
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: rs0LbVY81SKi1UQWrMluwyQTJRGH1mH/GbWp3Vr/faGCkG5500VMBYHIRIkh53SX0IdzNptIrAk=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 88b63cb2f8aab28c7291262ffc15282e.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb76a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1693233183379

GET
H3 200 header-lazy.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115388248694/1709752515544/humansecurity-hs/assets/css/ 62 KB
8 KB 161ms
147ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115388248694/1709752515544/humansecurity-hs/assets/css/header-lazy.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

92cde36d24b66c5bb39231c290e47319cc207455557a1c4ddf0b1c584422db77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 959b8cb6-4536-413d-a7d1-e26e481d76d6
content-encoding: gzip
cf-cache-status: HIT
etag: W/"ab9f490b09044ac8accc7cd47c303436"
age: 2010
x-amz-version-id: _V.JkPAY5XMXY1FxwyxeMEqz70RyFn88
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5FxWm1xgqePqCM8%2Bq%2BIgZmUmJJbPhqpzJSnhnL2OIe9opieTDqWEiCuml3xa8pbe9mEF7zWpH%2Bl7XQdSLjuZILHd2a9JVPah6%2FAs72g56N9HGLUVMzLM4Lqp%2BS3Rl0TJob7VUdvddg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: 8ysYxEHDMIVNkn01kaHvAemIIANyt74GpS0Q5RY1teErFEx8Ap0K-w==
x-hubspot-correlation-id: 959b8cb6-4536-413d-a7d1-e26e481d76d6
content-type: text/css
last-modified: Wed, 06 Mar 2024 19:15:17 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-7849459c5c-zmdpq
x-envoy-upstream-service-time: 188
x-amz-request-id: S71R8FEV40HHQCK7
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: origin, Accept-Encoding
x-amz-id-2: USltlvzVuaKYGEIwqunbEftYuGrzymkIi2QZCSfJqQDh2m/x+iYQEZ8nTBA96fP2/ZcSMsYqZFdJJC5dT+O2HA==
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront)
cf-ray: 8dabfa5bcb7aa1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1709752516468

GET
H3 200 shield-1.png
www.humansecurity.com/hubfs/ 7 KB
8 KB 75ms
72ms Image
image/webp 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.humansecurity.com/hubfs/shield-1.png

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

adfc35d72ea1d0feaa677acecd2dafad7fdda56b02a76d7f51ad1bc067c2d499

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
cf-cache-status: HIT
etag: "a7f612073c41fe336a127bcdc8c85fb1"
age: 71072
cache-tag: F-5862207449,P-3400937,FLS-ALL
x-amz-version-id: kbAwIB8JM8ZtMXzHq1eECCWREyj8TPx0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FQO%2BN1W9XVi9492O6VKArqH0Ka4%2B9rXhFyIQBPBOfePPC16X%2FH%2FqLYxMii8wMFD%2BkLtZRZA7LlaCbABRpDjX63BtZ9HGcj23%2Buc4xBejB6ogP1MUnMTGgEpjvRcTIWoR2uDKAgGk0A%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 95lP2IDhl0eveypJR4ALWRHG06yz1wJK2jVtJic-Wakk51PM1Gk_KA==
content-type: image/webp
content-disposition: inline; filename="shield-1.webp"
last-modified: Fri, 27 Sep 2024 14:40:23 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-5862207449,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: HFEKEGV8R897HKPR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-5862207449,P-3400937,FLS-ALL
content-length: 6658
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: origFmt=png, origSize=12483
date: Wed, 30 Oct 2024 14:08:32 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: OPaVkkQQsnVLR7ZVerwHSreAywdB18zWD3/to4wdjvDOu1sbVkUyFr3x974FIZdIeAfa/8tXP94=
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 019b4503d2ffede0ae900992ff140770.cloudfront.net (CloudFront)
cf-ray: 8dabfa5c5bfaa1ff-YYZ
access-control-allow-origin: *
x-amz-cf-pop: YTO50-P2
x-amz-meta-created-unix-time-millis: 1528484841175

GET
H3 200 HMN_Blog-images_2024_Konfety-technical.jpg
www.humansecurity.com/hubfs/ 244 KB
245 KB 423ms
421ms Image
image/jpeg 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.humansecurity.com/hubfs/HMN_Blog-images_2024_Konfety-technical.jpg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

17d527904615bb8d02f2fb91dd08227f626f5ba0aab65d6a820f2eb60fb2c673

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
cf-cache-status: MISS
etag: "ac43d5e9fa12a241c10f9fa8918243b1"
x-amz-version-id: AFUjL0oIFYu1ClDaAcMIAB.M4qworrYw
cache-tag: F-173067260473,P-3400937,FLS-ALL
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NRxqEUvoVY2qm9kWaZzFCM3G8O2oTSNbSAu3rnIhTAInFAXNAszgAZnIQxDLkTQJIRzFVnh%2BPlkdwKpl8bapkXhog3vytJcdV3qXmqSZDnZzmuUBAArzXscrMz7Nf8%2FYG6h3EyOMPw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: ij0J0J1jMhQWgWkOJmpjeoF7JbhSNokWawlB-Nqnn20IaHtaj6gS_Q==
content-type: image/jpeg
last-modified: Tue, 24 Sep 2024 18:42:57 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-173067260473,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 0XN4R6WQWAYAJ6Q0
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-173067260473,P-3400937,FLS-ALL
content-length: 249848
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: Accept-Encoding
x-amz-id-2: PtAqjwrDr1bzsUK2Lghhk+7Jir0XSeTNpBH1G02zAmC3nYBWAGSJw4AoZxY254vYaXMGcYgfViek9Wdk7gr3+g==
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 2080aae7ace369c71819923852e1b17e.cloudfront.net (CloudFront)
cf-ray: 8dabfa5c5bfea1ff-YYZ
access-control-allow-origin: *
x-amz-cf-pop: YUL62-P2
x-amz-meta-created-unix-time-millis: 1721076655796

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.1293/ 13 KB
5 KB 1062ms
68ms Script
application/javascript 2606:4700::6811:ac5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.1293/embed.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ac5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"f667e53d5752ee2e5759f3dfaf20d330"
x-amz-version-id: AFGFBaAC1397GFbOapH2DRIkjQ_NaZzY
age: 665013
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9yjhD9Qld73gkPsNw12Tv5GSa3k0Pwp%2FTlcfW3%2Fekjc3AXFed97NpMy7cDRDZGNaHM3ZmpcMCBzD8woLaBJN1OThtMTwtXXZgJ6KVvPvlSLlyZsa9sCVS%2BHx6%2FHoGjbrHd4YL%2FntkunU7yIt1C1jTdUlnFc%3D"}],"group":"cf-nel","max_age":604800}
expires: Thu, 30 Oct 2025 14:08:34 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: zWep2CrewDPaJFNoAeUbNFa6FVORrvSkna6RKs34ObTLUBMlE4SYag==
date: Wed, 30 Oct 2024 14:08:34 GMT
content-type: application/javascript
last-modified: Mon, 23 Sep 2024 19:59:06 GMT
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
cf-ray: 8dabfa685d56a2a6-YUL
x-amz-cf-pop: IAD12-P3
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 364ms
39ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "603e8adc-15d9d"
age: 597331
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UEeJC74nd7gV1nhzpfxIN3aJg6fqme6G58qAcafDzszPHnSKqyxTs3U8ZN4DC5pe3OmgH7qGjNmGNT9hrijdUh1QIPAsO26B%2B47ZliINKybIUHCiWDyXOoEHheaOG0Z4JlpOhtUD"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 20 Oct 2025 14:08:33 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Oct 2024 14:08:33 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8dabfa5eefbe5425-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27938
server: cloudflare

GET
H3 200 3400937.js Show response
www.humansecurity.com/hs/scriptloader/ 1 KB
1 KB 118ms
107ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs/scriptloader/3400937.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

01eb069a34fa7d0f7d4571700b2d32cc130349e970e0ec21e7a428c2fad465ab

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: HIT
age: 90
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7gg2DXfTvTJW4RCgnledom7HTxHrdDUkeHg4wHLJEJVf0l5bslFzGIcjLdXGrnuh%2BTwVn9ICMuNBITGN9GrA%2B7qQ7xPJ2PzWIoBg2iaH6KJYSBwbfHgjM%2FI%2BoRkhNtvjusbE%2BImHXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 30 Oct 2024 14:10:03 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Oct 2024 14:08:33 GMT
x-hubspot-correlation-id: 5401250c-366b-40b0-ad89-94dd7b2dd511
content-type: application/javascript;charset=utf-8
last-modified: Wed, 30 Oct 2024 14:07:03 GMT
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=90
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8dabfa62490fa1ff-YYZ
accept-ranges: bytes
access-control-allow-origin: https://www.humansecurity.com
content-length: 592
server: cloudflare

GET
H3 200 index.js Show response
www.humansecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/ 12 KB
5 KB 101ms
89ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/index.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

42c7e51d284cd7256caf3bfebf641141876657ea0d6e5588ac7e69dce1e9cf7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"3ef0deda0631561665e95645daf500a2"
age: 594600
x-amz-version-id: O3iI8Pl3bd7LIBbSsE98q3XHW8vfw5hp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=na5NtG90QXMhwiHNTNP%2Fiiijoy4A77JbxN5vlx5gkY%2FbH8HDJDC07BOnIjzKs0QSmeziv03jvGkUWVx9C7PUW9Y056CtL6NPbvDqEoen%2FyJ5rAY2gjJ9U2Rgg%2BQLlk9sc3ZdrbWTyw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Thu, 30 Oct 2025 14:08:33 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: kYxNF-TL2sqE614GyuRKC9hO6mOuwWIVeXq4UwKnpk9tfY9OMAjslQ==
date: Wed, 30 Oct 2024 14:08:33 GMT
content-type: application/javascript
last-modified: Wed, 21 Aug 2024 20:24:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 0df778cadb5eaa000de4f1d7838b16e0.cloudfront.net (CloudFront)
cf-ray: 8dabfa624911a1ff-YYZ
x-amz-cf-pop: YUL62-C2
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 prism.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065958246/1693233184177/humansecurity-hs/assets/js/dist/ 21 KB
8 KB 134ms
123ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/91065958246/1693233184177/humansecurity-hs/assets/js/dist/prism.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

439042e0204db71db38bb4cbe130c3e520d35a14c2d9f65200308eaf1886eb64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 41f55a5b-df95-4ccf-9382-996debd90810
content-encoding: br
cf-cache-status: HIT
etag: W/"e04540ffd56a0772a80fe4364a8bf233"
x-amz-version-id: zkFy2U0v.jSQC8vEXzv06RDRCJ.ugkoT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JjC3Ltotd7%2FbxWNfobcv%2BYhQPz9yhbzOiQhKDgM83f8aw2C9NwJIMvLf98b7tlHGnp49ukKKok8EdzH8Zixc%2B6mprSa3lsr8V65aF%2F2FJvIuKQxL97NzJ2KXA1EKTuBygVeo1GuKhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: uOp5njnQnZlr7Zg3OZPoHCDKg5P_jKDXIpyf_yrLDZpnq4h3YMX0ZA==
x-hubspot-correlation-id: 41f55a5b-df95-4ccf-9382-996debd90810
content-type: application/javascript; charset=utf-8
last-modified: Mon, 28 Aug 2023 14:33:05 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-7849459c5c-b2s92
x-envoy-upstream-service-time: 174
x-amz-request-id: 7RFP04AN4Z4GYR2Y
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: HCBQ4SPXDFmPrpM1vnWPOmQtvzEVezrpgJK+2BDOfqpyV9TW2o5o2npZa/llWDW5Mqzc/20zY2yjWYMXRZg+FQrjs2rNQ6Gy
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 a47a23f37fc6f8e50c6d5f0b1b9273c6.cloudfront.net (CloudFront)
cf-ray: 8dabfa624913a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1693233184509

GET
H3 200 lightbox-combo.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307516677/1698698455711/humansecurity-hs/punch/assets/css/dist/ 8 KB
4 KB 62ms
58ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307516677/1698698455711/humansecurity-hs/punch/assets/css/dist/lightbox-combo.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

671367c3c0e84517f31e61945cd9ba416f89eb653dbc3c4d1828518ef5c627e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 10b8abdb-e1b5-44ad-88c0-b223d0f62ae4
content-encoding: gzip
cf-cache-status: HIT
etag: W/"3d743ab0a1949bb9ac17908aa63faff8"
age: 90
x-amz-version-id: ELy4NSaJEl78PQk9TJ5aF_svDOrYHxB1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v8qZUmJiOy5P2uC3Zr0dspjHGCO7Af9H2%2FK0GmSIF5%2BCMRnPNAoX6LkY%2Fox7lH8xjP2HnmNE%2BvwOz5b6Ec6RiyeuDQ%2BvOhzpvPBCHTAGxU1ryXLBMXb2%2FOo4bSbzcm543vhZXpPhRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: LeqCksofrRakjXfx6r7JkcQkxqrq_nD6Cjo5gXH7nizYFYNSzbDphw==
x-hubspot-correlation-id: 10b8abdb-e1b5-44ad-88c0-b223d0f62ae4
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:57 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-n6klc
x-envoy-upstream-service-time: 153
x-amz-request-id: TQ0DQ9VYYTVK8B3M
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: +QqLxxjiEUDtruU8ydpIE2wmeWmTvyv1n5WB8MtMruFqYHfAzA6ZoDfRLlJmzHDr5yKyPTy98Rk=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 40c1e5c4b3789c2ca411f57891da3fe4.cloudfront.net (CloudFront)
cf-ray: 8dabfa607f7aa1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1698698456389

GET
H3 200 bulma-grid.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841263/1698698444648/humansecurity-hs/punch/assets/css/dist/ 26 KB
5 KB 64ms
63ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841263/1698698444648/humansecurity-hs/punch/assets/css/dist/bulma-grid.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

78142c1a0831423d3fee5308b442b24659445ac8d7c34b92bde6624cc012f4e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 5ec0255d-35c0-47cc-94d5-f38f2233871f
content-encoding: gzip
cf-cache-status: HIT
etag: W/"7e59b5a4545779f41e2037e047741bac"
age: 90
x-amz-version-id: 9qYDnhWep0M62FVMJnv5CyhdEIgIEl8a
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eeGsyxrDDOHKevR7BI1eDxodi62vFV78uHYW3iRiB0tvtXN1mfea%2FxJhZiJdhT%2FIyXk4OJaJThENHlkx3xKTxM2O%2FxpKpoSSb094vULQezI9Gj79xqJnVDGYIb4KYEnM3KM61Wb9Ow%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: JyUJomd5JpZo6T1cIY3GZS3N_qxkzOMdz2HHSFMHAdop5G2ZU6XdIA==
x-hubspot-correlation-id: 5ec0255d-35c0-47cc-94d5-f38f2233871f
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:46 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-bhmwl
x-envoy-upstream-service-time: 322
x-amz-request-id: TYAE6W2KQQZF4WR6
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: elLl3RZZpR0TG67HsIWjObO1sqvI6woM/Z7p0/+/YwRKGq7up176jEXXIaGvwiI/7pBelQSMJOaLajfTtQOw2EzOOft7nGAd
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront)
cf-ray: 8dabfa60dfd5a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698445418

GET
H3 200 flickity.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841264/1698698444616/humansecurity-hs/punch/assets/css/dist/ 2 KB
2 KB 94ms
92ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656841264/1698698444616/humansecurity-hs/punch/assets/css/dist/flickity.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

27d001801da9af0f66dfdc4b42a2a22ef3c91682ec36157d1e38c9c75e16bef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: e60f5aae-fffc-44a1-a25c-ea6bc8cce85a
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b75662d6f54e7a5c27d147376632748f"
age: 90
x-amz-version-id: Nbji9Bjxg49HIGnuSoWxjDbh9B0ruDRH
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BNu9JU1QMKHCquxX1QROC123s3xun8Ykfxio5%2B41%2F%2F7aUzMZd0EUAqj%2BCg%2BnptzIlU3wQxBgasgogTh6OPc0WtuK2Ll1D5YgyCRA0rYwuyWImLGMBvK%2Fsq%2BVc2AB4VemfmaYN1cFiw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: PTafGZfdfW-GZMa15c_Rigf8hfqwwIWz-1qU0xvMvIDGnpNk0NJeKw==
x-hubspot-correlation-id: e60f5aae-fffc-44a1-a25c-ea6bc8cce85a
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:46 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-4hrwm
x-envoy-upstream-service-time: 147
x-amz-request-id: 1ZJTE1KP2MGR1GHH
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: iw4VQADO0ounmMQ2ODYMEkYpjIvs6q6zvxIyIRmeSVxHxE32YjfhK/MckvrTYU/DG8ZJRNDteU4=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 85fc1201a1918facbeb30836e7391660.cloudfront.net (CloudFront)
cf-ray: 8dabfa611803a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698445246

GET
H3 200 custom.min.css
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115450692019/1698698457814/humansecurity-hs/assets/css/dist/ 0
1 KB 59ms
58ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115450692019/1698698457814/humansecurity-hs/assets/css/dist/custom.min.css

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 87881939-ad21-4e08-b0ae-c2cf1bef3120
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 90
x-amz-version-id: yPbyfUQgByZmsXz3Bv8lGkrQvoYQGHox
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RqmK5p4gcPVZfbC8zfEsLY6LV1aqSWEEDslrRMpa2Sled1D6sdWOtXWOrDCc1TWlqrDn5Jx1PSltXn5jVJHNbEk0dUX96EXIE5Hbx69TOGQnPIbPTEe7ayAmuM8RPO21UfFyhOvdzg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: HkA8Eeq9Khr7U59N2MsB5dVLLMDIWqZ4pYUXyKvo_SYehh04RUfHvA==
x-hubspot-correlation-id: 87881939-ad21-4e08-b0ae-c2cf1bef3120
content-type: text/css
last-modified: Mon, 30 Oct 2023 20:40:59 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-whvkh
x-envoy-upstream-service-time: 154
x-amz-request-id: EWWXE5V2JXBCN4M6
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
content-length: 0
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: MZiBOAltXEQfb1uCGbR/fpmHscPizqBCA8cmzWATEssVyZnGENfQW6aH2HSJON5ez27o5Jj2bms2hx4zTTx3ulMlfSN7n4s5xtedd4AjeUU=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 e7f87e384798b4a94964cbcf8e4db94c.cloudfront.net (CloudFront)
cf-ray: 8dabfa615840a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P2
x-amz-meta-created-unix-time-millis: 1698698458499

GET
H3 200 lazy-loading.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307132989/1698698445616/humansecurity-hs/punch/assets/js/ 3 KB
3 KB 104ms
88ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115307132989/1698698445616/humansecurity-hs/punch/assets/js/lazy-loading.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0d54140c9e5b41f4f5f8fd5583a8ae657452e2bec968966ab70c26d5ae77719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: a08a8dc4-d64e-427f-9646-a33438920732
content-encoding: br
cf-cache-status: HIT
etag: W/"4bad0a4c32f8ed6cc9ae26f79403ba1d"
age: 2011
x-amz-version-id: Yf5CV0qo3j47sw1HNl1JCGV8Teo7T9N0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v64nPuuVT%2Fk%2BeTpRbQ%2Btr9nt46aN7MdDUlZCzo4Au2njHK65NE0n8kbukUB3%2Bn%2B3WLwBNWOhdek5nsCDB2q%2Br%2BIZIVFcM3xi8prPChmbnYnLqXoFyw9OR3SoQ9Io00AxEBV8oxEGzw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: 5yt_LMrYylPn_lca60khNdvt9H4jgzpMJR5rsIb4eXx0T2qdtX6H5w==
x-hubspot-correlation-id: a08a8dc4-d64e-427f-9646-a33438920732
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:46 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-4cwxm
x-envoy-upstream-service-time: 172
x-amz-request-id: TQ08X82ZA6DMJC51
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: ELyT21Ea9P8LhPvLfZlEFgi/IjDU9CQEDHNf3fE6hDAVbNGs9PauTiYorNZHFEBY9lcSzBLuGP4JL/hBeCevyQ==
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 be4fef3f6c1b2c76e0341ff49a27ce40.cloudfront.net (CloudFront)
cf-ray: 8dabfa62490ca1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1698698445767

GET
H3 200 owl.carousel.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742850616/1713364613712/humansecurity-hs/assets/js/owlcarousel/ 43 KB
13 KB 108ms
93ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/164742850616/1713364613712/humansecurity-hs/assets/js/owlcarousel/owl.carousel.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 55bb2968-e893-4fde-819e-bdf46f42aa27
content-encoding: br
cf-cache-status: HIT
etag: W/"f416f9031fef25ae25ba9756e3eb6978"
age: 2011
x-amz-version-id: YXST8RJs5KZFT1MFRhfRhJxx14M2tAc1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ot9Nx0HwpFi46%2BOsql20yS8hq6GI1jF0bxkQ3h5eRvvTp1Mbvi2OOJKcy24FPLJ%2BF5%2FFLpZDm8%2F1KOrUTaR4EOoJI%2F2vwg0UTFN01Nq3UDsIQr32JMWc4TmjBIVWsnWLAtRuIUPUng%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: RBkKKs-WO9LoYu0PYwMvDLEgy-a-U-9xs77xYP3LContKngsMPKVHA==
x-hubspot-correlation-id: 55bb2968-e893-4fde-819e-bdf46f42aa27
content-type: application/javascript; charset=utf-8
last-modified: Wed, 17 Apr 2024 14:36:54 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-d8n8d
x-envoy-upstream-service-time: 210
x-amz-request-id: E20JW5PP5MNCA83S
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: M9/Db4G23xGepFqfZW2iuVEmeQHjLYcM5cyP8QNR07R1zJ6M+YC89XqoVtJqsnSQxZW+hEdSPR4=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 19a26748942db0d3fcb162b26019f692.cloudfront.net (CloudFront)
cf-ray: 8dabfa62490da1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1713364613712

GET
H3 200 frontend.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656674711/1698698447070/humansecurity-hs/punch/assets/js/ 7 KB
4 KB 96ms
84ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63656674711/1698698447070/humansecurity-hs/punch/assets/js/frontend.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd5e60442181c68a2711c4a407db551e51e0af167f16b86775ceb7e56679a045

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 187bf549-6d44-42e4-881c-6d8267d961b3
content-encoding: br
cf-cache-status: HIT
etag: W/"a4f49c0d3a6711894e9c55d1c0c7de21"
age: 2011
x-amz-version-id: 9kHHRG.4lQ.A7FuJiqDBrnDLMH9bi.w1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F07HeYsG8AW8yZHoY0k4UELnR%2BYWSS6zTpit1%2B9TsIRVEy1dCjVXkJPocVQgaK%2FCbxz9dVMu4PpYOp1pyCus87hv%2FHjAMrDz%2BNnYHLSnDVIfo11rDRiYk7aMgzYQ2Un7lRpzsnmX3w%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: nQ8jLW7V8QFe0eFXf88A4OReMVIjHjK6MrDWu5AROP7qigYaUyH-SQ==
x-hubspot-correlation-id: 187bf549-6d44-42e4-881c-6d8267d961b3
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:48 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-kmqkd
x-envoy-upstream-service-time: 148
x-amz-request-id: D4X7JSZRR9NZDG8N
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: SxDJaSeTNrNAIim3BqAZiXD/4t0aMmThRYi6PdJ1ktdSsIrYYzgW+YX+mD5YDqgXguLLCDopeWE=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 0fbab52df0695e2a561cd26eb7f9484c.cloudfront.net (CloudFront)
cf-ray: 8dabfa624914a1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698447313

GET
H3 200 main.min.js Show response
www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820292/1701277809330/humansecurity-hs/assets/js/ 5 KB
3 KB 91ms
78ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820292/1701277809330/humansecurity-hs/assets/js/main.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d651066ec06c641549632f4776b2cdbf638ca0786adf1c58f44a2728daed9b00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 8e12b415-cbdd-4b6b-93f2-be1d6a424d4b
content-encoding: br
cf-cache-status: HIT
etag: W/"685174d68af17bd7d0e6a28ceb5be545"
age: 2011
x-amz-version-id: vY8wV06NgfCiTijo9TsZU9.WhSQoNj73
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q4ckpWGB2bCg7PuCNY6L6FhiuP2lGX5O3WU90yAYRes2MWO36BVSE5OuZvluG%2BA23Uw5UCS%2BSYQlADHjVK6ACVg90Yc4buNvhm6cgALHxklXrMNSf%2BrnQlJdrfXVxV%2FJn8i89qW%2F3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: uEDlRXwRvzY8ETYmYlgGf1MKSjbelsD_SXSWWNTNU4eu-YrS9qNL7Q==
x-hubspot-correlation-id: 8e12b415-cbdd-4b6b-93f2-be1d6a424d4b
content-type: application/javascript; charset=utf-8
last-modified: Wed, 29 Nov 2023 17:10:10 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-679cd85c5c-n6klc
x-envoy-upstream-service-time: 198
x-amz-request-id: 6R5B0C8YF1T15PP7
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: origin, Accept-Encoding
x-amz-id-2: wSJjNBJVkVSJbmO5KyfoTiKlgojhMg5BcD5Vq9wbRHRAh691/nmHe6oLEe+2/XH32FZzukeBBWQ=
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.humansecurity.com
access-control-allow-credentials: false
via: 1.1 95ad9d4dc596fb803e3114c8dbdc4b60.cloudfront.net (CloudFront)
cf-ray: 8dabfa62490ea1ff-YYZ
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1701277809525

GET
H2 200 css2
fonts.googleapis.com/ 15 KB
1 KB 409ms
85ms Stylesheet
text/css 2607:f8b0:4004:c1b::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3e96e51bce41e61ed84d7d3bd61411f019a3098dfeaf2230a5a948ee2431471e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/63463820289/1715786988598/humansecurity-hs/assets/css/main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 30 Oct 2024 14:08:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:33 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 30 Oct 2024 14:08:33 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 1060ms
68ms Script
application/javascript 2620:1ec:33:2::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:2::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1F7356213FBA42D89DAA50FE37D30523 Ref B: CH1AA2020615025 Ref C: 2024-10-30T14:08:34Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Wed, 30 Oct 2024 14:08:33 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H3

200

landing
googleads.g.doubleclick.net/pagead/
Redirect Chain

https://www.google.com/pagead/landing?gcs=G1--&gcd=13l3l3l3l5l1&tag_exp=101533422~101823848~101878899~101878944~101925629&rnd=627229214.1730297314&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2F...
https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5l1&tag_exp=101533422~101823848~101878899~101878944~101925629&rnd=627229214.1730297314&url=https%3A%2F%2Fwww.humansecurity.c...

42 B
65 B

311ms
46ms

Ping
image/gif

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5l1&tag_exp=101533422~101823848~101878899~101878944~101925629&rnd=627229214.1730297314&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&dma=0&npa=0&gtm=45He4as0n81KVP42DDv830094232za200&auid=1303771909.1730297314&apve=0

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Wed, 30 Oct 2024 14:08:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5l1&tag_exp=101533422~101823848~101878899~101878944~101925629&rnd=627229214.1730297314&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&dma=0&npa=0&gtm=45He4as0n81KVP42DDv830094232za200&auid=1303771909.1730297314&apve=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 30 Oct 2024 14:08:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 1060ms
68ms Script
text/javascript 2607:f8b0:4006:80a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
age: 2490
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Wed, 30 Oct 2024 15:27:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 13:27:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 288 KB
98 KB 118ms
90ms Script
application/javascript 2607:f8b0:4006:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-878225418&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7c77cc0202a4ac0596bbca2826213c389483ee22bf66f3147ffecc085d879782

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 30 Oct 2024 14:08:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 30 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 100468
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 1065ms
75ms Script
application/javascript 2600:141b:1c00:6::17df:d145
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:6::17df:d145 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: max-age=53049
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Wed, 30 Oct 2024 14:08:34 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 hotjar-3389720.js Show response
static.hotjar.com/c/ 13 KB
5 KB 1066ms
76ms Script
application/javascript 108.138.106.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3389720.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.106.101 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-106-101.jfk50.r.cloudfront.net

Software

Resource Hash

6e36481c240a1940e57031e63729135b8c824f4b522c12d1effc0daf01d54e09

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
etag: W/fc252170669259282895a5e2e7d25b23
age: 16
x-content-type-options: nosniff
x-cache-hit: 1
x-cache: Hit from cloudfront
x-amz-cf-id: 0zQfqrRcquM9gwuzNnG8JTkKfTwl0XUp2sSGJBCZ0i_AwLDdAmR3ag==
date: Wed, 30 Oct 2024 14:08:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
via: 1.1 8ef35b07fe667674a2922c9d83a75c52.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 977ms
167ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
etag: W/"b2877da906a3216c4f3fc4030b205e54"
age: 76632
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: hooVwhDzUYU-43VvitcUmaW-9sgmpw9XKVS_1S_Ta6g1pnc9-Qhbzw==
date: Wed, 30 Oct 2024 14:08:34 GMT
content-type: application/javascript
last-modified: Thu, 18 Jul 2024 08:13:46 GMT
vary: Accept-Encoding
via: 1.1 5fdbf75fe42f57cdc3d155f7290c5a9e.cloudfront.net (CloudFront)
cf-ray: 8dabfa675fc1a214-YYZ
x-amz-cf-pop: YUL62-C2
server: cloudflare

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 45DA 0
0 264ms
28ms Document
text/html 2607:f8b0:4006:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.humansecurity.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 580506
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Oct 2024 20:53:28 GMT
expires: Thu, 23 Oct 2025 20:53:28 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 201b591d8778f953b5cde276d197d939dbc151d21e948d0e91d8869901f9eeb8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 Single-Post-Hero-Bg@1x.jpg
www.humansecurity.com/hubfs/Website%20Assets/Backgrounds/ 15 KB
17 KB 208ms
197ms Image
image/webp 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.humansecurity.com/hubfs/Website%20Assets/Backgrounds/Single-Post-Hero-Bg@1x.jpg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/single-common.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b84398de46283985db9507da817ab6fd1c66687b7b9f6d1bf3e0de29bc2b3e28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/hs-fs/hub/3400937/hub_generated/template_assets/115451707707/1709753002216/humansecurity-hs/assets/css/single-common.min.css

Response headers

x-robots-tag: none
cf-cache-status: HIT
etag: "dd6b6465df335a37717da6c525533fc1"
age: 272957
cache-tag: F-115446220894,FD-65670907291,P-3400937,FLS-ALL
x-amz-version-id: YO9TbFZMzmWCAQ.yyqbx4F0duFzNtu7i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FRIoUiYxtil1u4fV2LZEJs%2BjAsimtCf61mDAODzDqXlMw0ITaAj2%2BDhtImni7qbOFplOxAX0avrDVvb3VyHjFEXubLd53GOsQTrQR%2F%2FvGyhlcAt%2BYoiMhtBIAHzSRmVPGV7r40tR3A%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: RwN7YeG-2vpgfHfm87uFbY1RifKstQhufqCta6_WTScoVRWa6j6LjA==
content-type: image/webp
content-disposition: inline; filename="Single-Post-Hero-Bg@1x.webp"
last-modified: Fri, 27 Sep 2024 14:15:30 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-115446220894,FD-65670907291,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 8XBK78FQAVKC858C
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-115446220894,FD-65670907291,P-3400937,FLS-ALL
content-length: 15628
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: qual=85, origFmt=jpeg, origSize=34092
date: Wed, 30 Oct 2024 14:08:33 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: 1ixpWxbTuvobsPbgE0BLpv/e06sPfXoYoxu7duQp1SNRPZQgSoO8aUxaHPI0f9jf3AetWfQNhNU=
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
cf-ray: 8dabfa6309b6a1ff-YYZ
access-control-allow-origin: *
x-amz-cf-pop: YUL62-P2
x-amz-meta-created-unix-time-millis: 1684015842832

GET
H3 200 7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 530ms
79ms Font
font/woff2 142.251.40.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f3.1e100.net

Software

sffe /

Resource Hash

7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 580631
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 20:51:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 20:51:23 GMT
last-modified: Tue, 19 Apr 2022 19:43:23 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21144
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 551ms
101ms Font
font/woff2 142.251.40.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f3.1e100.net

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 580745
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 20:49:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 20:49:29 GMT
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21724
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54a00c1f0eaaeb0537a8297cda238d8d96c0441a708ebaba46e4f473ac94e689

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer

Response headers

Content-Type: font/truetype;charset=utf-8

GET
H3 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 21 KB
21 KB 529ms
80ms Font
font/woff2 142.251.40.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f3.1e100.net

Software

sffe /

Resource Hash

8320299532b4b81498d5b3714d49c9d5938883b55f4c2a1efe6f105bf4a942bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 579651
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 21:07:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 21:07:43 GMT
last-modified: Tue, 19 Apr 2022 18:46:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21440
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ 20 KB
20 KB 537ms
88ms Font
font/woff2 142.251.40.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f3.1e100.net

Software

sffe /

Resource Hash

7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 581356
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 20:39:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 20:39:18 GMT
last-modified: Tue, 19 Apr 2022 19:18:28 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20960
x-xss-protection: 0
server: sffe

GET
H2 200 5210.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 2 KB
2 KB 603ms
89ms Script
text/javascript 2606:4700::6812:1eb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/5210.js?p=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&e=

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be99b037586f1d31100f6205fb7650348bc715c0091a5495c3cb8ad8a3145ef4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
date: Wed, 30 Oct 2024 14:08:34 GMT
content-type: text/javascript;charset=UTF-8
content-disposition: inline
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
referrer-policy: no-referrer
x-download-options: noopen
cf-ray: 8dabfa68a8947138-YUL
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1
server: cloudflare

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 516ms
69ms Script
application/x-javascript 23.204.6.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-204-6-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Content-Encoding: gzip
ETag: "49bb20382072bfb6b798a6f4c6ab8354:1730261707.305765"
Connection: keep-alive
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 746
Date: Wed, 30 Oct 2024 14:08:34 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 30 Oct 2024 04:15:07 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 main.min.js Show response
client.px-cloud.net/PXxDhGmtcm/ 168 KB
70 KB 483ms
62ms Script
application/javascript 2600:141b:1c00:30::1739:5a6c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:30::1739:5a6c Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: ff1c989f85ae2a4c46b9ddf099129a3858ac5c476d5e0ecaaa0d68605cddd871

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: max-age=600
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
content-encoding: gzip
etag: "369dc0777ecafe8aa85a233c99aef375"
active-cdn: Akamai
expires: Wed, 30 Oct 2024 14:17:58 GMT
accept-ranges: bytes
access-control-allow-origin: *
x-goog-stored-content-length: 71362
content-length: 71362
date: Wed, 30 Oct 2024 14:08:35 GMT
last-modified: Wed, 30 Oct 2024 13:27:32 GMT
content-type: application/javascript; charset=utf-8
server: UploadServer
vary: Accept-Encoding

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 437ms
43ms Script
text/javascript 54.146.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-148-156.compute-1.amazonaws.com
Software: /
Resource Hash: d40978953ca7c452dea9ccf74628215b6918fd446e52ef0c15b34dda309c34bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: text/javascript

GET
H2 200 1469bf09af802378.min.js Show response
tag.demandbase.com/ 61 KB
18 KB 383ms
26ms Script
application/javascript 52.85.61.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/1469bf09af802378.min.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.61.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-61-60.ewr53.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d5ea4cc18382ea8b4bab715faf7d7e79780f7b49e4b5b4e24bed6161d58cd9b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
x-amz-version-id: gGzcpCiwq0gpveBlMpdJJkXCtl6MzwAx
etag: W/"5f4b5d37106de70ebec5c112598e080f"
age: 2537
x-cache: Hit from cloudfront
x-amz-cf-id: xCWPBKdwkgOZ1B2qZUlfTqIU3jmzLiigxSBAOzT-aov_9F_8uLPVDg==
date: Wed, 30 Oct 2024 13:26:19 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Tue, 22 Oct 2024 18:41:54 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 34deee8ac34d726c1404a3045667664a.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: EWR53-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 255ms
28ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

d4e466950479eeb209f16bff7e818a991f22368eebcd3559cc45bed67b2fd92d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: s6FygG24m7SZl7NebeFSyw==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "545ba63a8c2f8228e28fe81df2ef4b20"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 30 Oct 2024 14:17:24 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Oct 2024 14:08:34 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 6fb1d9dac176c58ccf6e828cb8da0e2a
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=24, rtx=0, c=23, mss=1232, tbw=4600, tp=12, tpl=0, uplat=0, ullat=-1
x-fb-debug: HXd0wVJxZnZP4mbzacMz38E4TqfNyDlxtK8OSPpdm57KXT6Z3J2NmsrVV0Sj1rInkE2mJIFCr2t9IEw7nTLBqg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1687
origin-agent-cluster: ?1

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 754ms
202ms Script
application/javascript 151.101.44.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.44.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
access-control-allow-methods: GET
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Wed, 30 Oct 2024 14:08:35 GMT
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kcgs7200137-IAD, cache-nyc-kteb1890022-NYC
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27597
x-amz-server-side-encryption: AES256

GET
H2 200 3400937.js Show response
js.hs-banner.com/ 61 KB
19 KB 704ms
165ms Script
text/javascript 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3400937.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/scriptloader/3400937.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02a711f90cf3fe3f3c91c838aa383dd9bc60d67b59e678328975e2193c1ce1d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-evy-trace-virtual-host: all
access-control-max-age: 604800
x-request-id: 631584a6-d64e-4112-9e41-8d9cef425b36
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"7df6ee72098e64058dcb0f86caf8fbf0"
x-amz-version-id: j3Z3MHDFFIrOvQEWaUYKy.NfZW7yr8Jm
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires: Wed, 30 Oct 2024 14:13:35 GMT
x-evy-trace-listener: listener_https
date: Wed, 30 Oct 2024 14:08:35 GMT
x-hubspot-correlation-id: 631584a6-d64e-4112-9e41-8d9cef425b36
content-type: text/javascript; charset=UTF-8
last-modified: Fri, 29 Mar 2024 16:23:31 GMT
vary: origin, Accept-Encoding
x-amz-id-2: grC2MkMbwCxfxKzSLdEMYkKlF7LbOphkZ4tTSaPAeJraVfcaJcBgLGocRPZ3tZqL0KiMZ+g80ss=
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
timing-allow-origin: *
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-792r6
x-envoy-upstream-service-time: 38
access-control-allow-credentials: true
x-amz-request-id: 1DGMFEB9QACF8Q8R
cf-ray: 8dabfa6ccbb1a24b-YUL
access-control-allow-origin: https://www.humansecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 550 KB
92 KB 733ms
201ms Script
application/javascript 2606:4700::6812:8d11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/scriptloader/3400937.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8d11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d44882ab82adeef2856a0d52fb54bb70e472be45d50aa3a16b4cb39223391a99

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 3b19cb74-b54f-4b3e-a6d6-b7302ab79849
content-encoding: gzip
cf-cache-status: HIT
etag: W/"ce26171eff05376a1b746efbb809f7f6"
x-amz-version-id: 1P48dmUoAxkQ57N6qBxgDzS3oBmZAXBF
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
age: 67834
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: SELlTosk61_bI307ZBcVsFG8M0oHgE-eoS1wziOwGaaM0rO0hi93Dw==
x-hubspot-correlation-id: 3b19cb74-b54f-4b3e-a6d6-b7302ab79849
content-type: application/javascript; charset=utf-8
last-modified: Wed, 09 Oct 2024 10:17:06 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=86400, max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-6c6dd6864-86kmn
x-envoy-upstream-service-time: 6
x-hs-target-asset: lead-flows-js/static-1.1724/bundle/main/lead-flows-release.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Wed, 30 Oct 2024 14:08:35 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1724/bundle/main/lead-flows-release.js&cfRay=8cfda1694c8b5caf-ATL
via: 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront)
cf-ray: 8dabfa6cca4ea2c8-YUL
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 3400937.js Show response
js.hs-analytics.net/analytics/1730297100000/ 68 KB
25 KB 735ms
202ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1730297100000/3400937.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/scriptloader/3400937.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bfe0695ae8a623e3bfb51affa85f41a5593014633878b4489b449d3a37a444b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-amz-server-side-encryption: AES256
x-request-id: 7159a942-a4ed-48ed-921b-c6e89fd556d2
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6089bc2ec0488a8b060be0412ff3099d"
x-amz-version-id: null
expires: Wed, 30 Oct 2024 14:12:04 GMT
x-evy-trace-listener: listener_https
date: Wed, 30 Oct 2024 14:08:35 GMT
x-hubspot-correlation-id: 7159a942-a4ed-48ed-921b-c6e89fd556d2
content-type: text/javascript
last-modified: Tue, 22 Oct 2024 20:41:08 GMT
vary: origin, Accept-Encoding
x-amz-id-2: x5bI8QKBkl+4jl/zsRVaQ8yg3YyYkcjMon1PUxRagNGdTezzvE9Le4DRnoblEg6ZocB0mih6nuIft/V1QrZYlfODW/Xx6YQj
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-ft4sn
x-envoy-upstream-service-time: 25
access-control-allow-credentials: false
x-amz-request-id: 5NS95VSW0N4Y2FPN
cf-ray: 8dabfa6cce64a2cc-YUL
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
DATA 200
OK truncated
/ 378 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2fc92a4b6bcd0e8fdd8b4939e421646379410fc25266f0fb5f1abf07a843f93e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 133ms
87ms Font
font/woff2 142.251.40.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@300;400;500;600;700;800&family=Barlow:wght@300;400;500;600;700;800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f3.1e100.net

Software

sffe /

Resource Hash

2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 575632
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 22:14:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 22:14:42 GMT
last-modified: Tue, 19 Apr 2022 19:35:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21796
x-xss-protection: 0
server: sffe

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/878225418/ 6 KB
2 KB 143ms
65ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/878225418/?random=1730297314628&cv=11&fst=1730297314628&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9102558839z8830094232za201zb830094232&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&hn=www.googleadservices.com&frm=0&tiba=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&npa=0&pscdl=noapi&auid=1303771909.1730297314&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-878225418&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

4bc908c52457230d76ec146815431d06f3300b3854f4da6b2a11b210dad84fd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2461
date: Wed, 30 Oct 2024 14:08:34 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 878225418
td.doubleclick.net/td/rul/ Frame CDFA 0
0 767ms
94ms Document
text/html 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/878225418?random=1730297314628&cv=11&fst=1730297314628&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9102558839z8830094232za201zb830094232&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&hn=www.googleadservices.com&frm=0&tiba=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&npa=0&pscdl=noapi&auid=1303771909.1730297314&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-878225418&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Oct 2024 14:08:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 main.min.js Show response
client.px-cloud.net/PXf69I9fY8/ 168 KB
70 KB 235ms
31ms Script
application/javascript 2600:141b:1c00:30::1739:5a6c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:30::1739:5a6c Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 4745aa4dd0933ecc7b66330588a90d216dd3207ca5e8720c0f10a61c00ebd6ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: max-age=600
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
content-encoding: gzip
etag: "58e007bf5c2b729b048f010238f7974e"
active-cdn: Akamai
expires: Wed, 30 Oct 2024 14:18:05 GMT
accept-ranges: bytes
access-control-allow-origin: *
x-goog-stored-content-length: 71353
content-length: 71353
date: Wed, 30 Oct 2024 14:08:35 GMT
last-modified: Wed, 30 Oct 2024 14:05:45 GMT
content-type: application/javascript; charset=utf-8
server: UploadServer
vary: Accept-Encoding

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
587 B 131ms
131ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f03338548b90c8048f4814e02bf4f9ab5daedf23ce3cb50db0d345d6b2a8f6a6

Request headers

Authorization: Bearer a6151318a91681741142
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"cb-C7FKU6ghS0n12HBdxbZebZ8ZNyg"
apigw-requestid: Ad6bhgo8PHcEMCQ=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: mh8WQUtW_ggnyx6AYokDxNBkEKIO97m37u-b3bPAYjaGLABiDiSuMA==
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/json; charset=utf-8
vary: Origin
via: 1.1 47373525d370c4b58e8b2be88c66f646.cloudfront.net (CloudFront)
cf-ray: 8dabfa6a49b93987-YYZ
access-control-allow-origin: https://www.humansecurity.com
x-amz-cf-pop: YUL62-C2
x-powered-by: Express
server: cloudflare

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 144ms
113ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=86400
apigw-requestid: Ad6bgh03vHcEMJg=
cf-cache-status: DYNAMIC
cf-ray: 8dabfa6999343987-YYZ
date: Wed, 30 Oct 2024 14:08:34 GMT
server: cloudflare
vary: Origin
via: 1.1 0588a12f9163167120c7c5e825e9110a.cloudfront.net (CloudFront)
x-amz-cf-id: btboKQNK6CX2qISP7lyJqBdafUfHKgSK-vj-6MyZWE4yuLgm5v1-AQ==
x-amz-cf-pop: YUL62-C2
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 10c1c946-3ec8-49a0-92ce-5be53945f2bc.json Show response
cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/ 4 KB
2 KB 96ms
47ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/10c1c946-3ec8-49a0-92ce-5be53945f2bc.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4a42e8f77ed647b32311ffc6b611bdc77b6296726e51cfc958ac736c63a6654

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: gKPVf/0JY7LPyMXBubVDLg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DB817650AF29D1
age: 56529
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 31 Oct 2024 14:08:35 GMT
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/json
last-modified: Mon, 10 Jul 2023 18:48:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 177d59bd-c01e-005e-4b4c-266089000000
cf-ray: 8dabfa6b7cc2a322-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1651
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 697ms
97ms XHR
text/plain 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=3400937

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: d24362d2-b513-4d07-8bc9-13257f0a0b22
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-methods: GET
x-content-type-options: no-sniff
x-evy-trace-listener: listener_https
date: Wed, 30 Oct 2024 14:08:35 GMT
x-hubspot-correlation-id: d24362d2-b513-4d07-8bc9-13257f0a0b22
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8dabfa6ed930714a&resource=unknown"
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-86c46c9777-sfn82
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
cf-ray: 8dabfa6ed930714a-YUL
access-control-allow-origin: https://www.humansecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 70ms
67ms Script
application/x-javascript 23.204.6.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-204-6-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Fri, 07 Feb 2025 14:08:35 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Wed, 30 Oct 2024 14:08:35 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 modules.625495a901d247c3e8d4.js Show response
script.hotjar.com/ 221 KB
55 KB 460ms
31ms Script
application/javascript 18.164.96.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.625495a901d247c3e8d4.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3389720.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-87.jfk50.r.cloudfront.net

Software

Resource Hash

c0d57eff0936a57e0c8d6bc93314585c734e5ade88d6de970e1e305ae5d87224

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
content-encoding: br
etag: "862c1be6e71cd836a43ce679991261fd"
age: 165928
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: wmv_VzSkHvr1rB_s_IvYq35Sun7CQjuKfv93RSqTM0ijkL4c_vF5GA==
date: Mon, 28 Oct 2024 16:03:06 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 28 Oct 2024 16:02:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56056
x-amz-cf-pop: JFK50-P5

POST
H2 200 assign
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 64ms
61ms Ping
text/html 2606:4700::6812:1eb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by: Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/5210.js?p=https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&e=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryI2czoAFElNVIQmAY
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

GET
H2 200 97050842.js Show response
bat.bing.com/p/action/ 370 B
425 B 43ms
40ms Script
application/javascript 2620:1ec:33:2::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/97050842.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:2::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

fce461e0fefe1d6d687b3eab8304d3affaf23fb674b18bfb5242ccfc544e1bb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 07273A0E3D8E43828CF0E0567338BB76 Ref B: CH1AA2020615025 Ref C: 2024-10-30T14:08:35Z
x-cache: CONFIG_NOCACHE
date: Wed, 30 Oct 2024 14:08:34 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
705 B 476ms
82ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: F0124E560C9446D1B7A3176A6F372683 Ref B: YMQ01EDGE0309 Ref C: 2024-10-30T14:08:35Z
x-li-fabric: prod-ltx1
access-control-allow-credentials: true
x-li-uuid: AAYlsjzblIyJyYfvRSDaLg==
x-li-proto: http/2
access-control-allow-origin: https://www.humansecurity.com
x-cache: CONFIG_NOCACHE
date: Wed, 30 Oct 2024 14:08:34 GMT
vary: Origin

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
814 B 487ms
94ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=1755754%2C5211716&time=1730297315264&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-fs-uuid: 000625b23cdb954b4c7cfd74413bc7ab
x-msedge-ref: Ref A: AD7849D91E34478ABC4A9BA98832A470 Ref B: YMQ01EDGE0613 Ref C: 2024-10-30T14:08:35Z
x-li-fabric: prod-ltx1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYlsjzblUtMfP10QTvHqw==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Wed, 30 Oct 2024 14:08:34 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730297315264&li_adsId=d3a23c2a-07a1-42cd-af43-b83f2ff6abfe&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730297315264&li_adsId=d3a23c2a-07a1-42cd-af43-b83f2ff6abfe&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsator...

0
483 B

228ms
122ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730297315264&li_adsId=d3a23c2a-07a1-42cd-af43-b83f2ff6abfe&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2&e_ipv6=AQJw9hitUGaEAwAAAZLdwcF3CfR5ed4ui4iaBGBPeemZyb_2B_1EM99DIC6DlezIuchI3jRz
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: F95CFABC07DE4B14A9E85179C6C82B5E Ref B: YMQ01EDGE0410 Ref C: 2024-10-30T14:08:35Z
x-li-fabric: prod-ltx1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYlsjzgnGwTUcxocPSXWA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1755754%2C5211716&time=1730297315264&li_adsId=d3a23c2a-07a1-42cd-af43-b83f2ff6abfe&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&tm=gtmv2&e_ipv6=AQJw9hitUGaEAwAAAZLdwcF3CfR5ed4ui4iaBGBPeemZyb_2B_1EM99DIC6DlezIuchI3jRz
x-msedge-ref: Ref A: D2B98883FC914AE698203B08FD685BDA Ref B: YMQ01EDGE0309 Ref C: 2024-10-30T14:08:35Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYlsjzboQx4xOlttTb3RA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Oct 2024 14:08:34 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
425 B 222ms
207ms XHR
text/plain 2607:f8b0:4006:80a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=417258359&t=pageview&_s=1&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&ul=en-ca&de=UTF-8&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABAAAAACAEK~&jid=158750466&gjid=122063243&cid=1371297405.1730297315&tid=UA-111948466-2&_gid=976550459.1730297315&_slc=1&gtm=45He4as0n81KVP42DDv830094232za200&cd7=2024-10-30T07%3A08%3A33.594-07%3A00&cd8=f3558ec1-e37c-43b8-bc96-68c8bd3aea99&gcs=G1--&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&cd3=1371297405.1730297315&z=1265162072

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:35 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.humansecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
650 B 400ms
43ms XHR
text/plain 2607:f8b0:4004:c09::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-111948466-2&cid=1371297405.1730297315&jid=158750466&gjid=122063243&_gid=976550459.1730297315&_u=YGBAgEABAAAAAGAEK~&z=1201493395

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:35 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://www.humansecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H/1.1 204
No Content clear.js Show response
s.cdnsynd.com/2/259353/ 0
64 B 647ms
66ms Script
text/plain 54.91.78.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s.cdnsynd.com/2/259353/clear.js?dt=2593531613684042609000&pd=mkt&gci=1371297405.1730297315&gtr=UA-111948466-3&gdc=1&gdb=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.91.78.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-91-78-159.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Date: Wed, 30 Oct 2024 14:08:35 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
38 B 245ms
173ms XHR
text/plain 142.250.80.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=417258359&t=pageview&_s=1&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&ul=en-ca&de=UTF-8&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDAAEABAAAAAGAEK~&jid=2032102128&gjid=276496991&cid=1371297405.1730297315&tid=UA-111948466-3&_gid=976550459.1730297315&_r=1&_slc=1&gtm=45He4as0n81KVP42DDv830094232za200&cd1=1371297405.1730297315&gcs=G1--&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&cd2=Human&z=1388819106

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

067536b3f91d4c08a72a02644605c37436afe7b1e60e0e251f298d5ccb082e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:35 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.humansecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

GET
H3 200 /
www.google.com/pagead/1p-user-list/878225418/ 42 B
64 B 245ms
171ms Image
image/gif 142.251.40.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/878225418/?random=1730297314628&cv=11&fst=1730296800000&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9102558839z8830094232za201zb830094232&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&hn=www.googleadservices.com&frm=0&tiba=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&npa=0&pscdl=noapi&auid=1303771909.1730297314&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d1s42UK17nvq26SEUuaO9ndANspg_tg&random=3682441566&rmt_tld=0&ipr=y

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.132 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 30 Oct 2024 14:08:35 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/878225418/ 42 B
64 B 310ms
54ms Image
image/gif 142.251.32.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/878225418/?random=1730297314628&cv=11&fst=1730296800000&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9102558839z8830094232za201zb830094232&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&hn=www.googleadservices.com&frm=0&tiba=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&npa=0&pscdl=noapi&auid=1303771909.1730297314&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d1s42UK17nvq26SEUuaO9ndANspg_tg&random=3682441566&rmt_tld=1&ipr=y

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.99 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 30 Oct 2024 14:08:35 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 283 KB
81 KB 242ms
170ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=a09224e08a386442aadc99635dfdc618

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

78e9659e7f8934d4952c29ce9974c0544d99243314eb56115c632a7ebc3a8b68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.humansecurity.com
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: jHuj4wjFc1YuyGzBvMQmdA==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "ce41041e9b0d61d818127250a5cf64d7"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 30 Oct 2025 12:05:36 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: d5feefa1b2e9d8f07385f782211124fb
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=21, mss=1232, tbw=2296, tp=9, tpl=0, uplat=1, ullat=-1
x-fb-debug: rYMV7RDv1fP0QhbLOphB3C6un+KbGIAO+uixZNZVl3JWnTX9ZiMy3nElxW0+wEIRpXHGhGbfAB1rraye8UpY3Q==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 82597
origin-agent-cluster: ?1

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 67 B
305 B 428ms
45ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66707b7434e14fc523f2fc692e4a190958a02598dd3d9c45ec0f65f90091727b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8dabfa6fb9e1a2c2-YUL
access-control-allow-origin: *
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 sync
s.company-target.com/s/ Frame 7AFE 0
0 430ms
49ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.company-target.com/s/sync?exc=lr

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/1469bf09af802378.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

22.71.96.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Wed, 30 Oct 2024 14:08:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google

GET
H/1.1

200
OK

log
segments.company-target.com/
Redirect Chain

https://id.rlcdn.com/464526.gif
https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCOP7iLkGEgUI6AcQAEIASgA
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297s7JTH6MeeajvaG_V012JSDJZAFWCuzFeXGrYi-VZWVo

26 B
349 B

192ms
37ms

Image
image/gif

13.226.94.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297s7JTH6MeeajvaG_V012JSDJZAFWCuzFeXGrYi-VZWVo
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: HTTP/1.1
Server: 13.226.94.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-94-10.jfk52.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Connection: keep-alive
Via: 1.1 7922a002a59b7f43e6eb47ceba9a3654.cloudfront.net (CloudFront)
X-Cache: Miss from cloudfront
Content-Length: 26
X-Amz-Cf-Id: UIW_GacXWCyn0co5pxNEZDHOrC78t4hU_ZnB61g_bW9LV6aJyd8LaQ==
Date: Wed, 30 Oct 2024 14:08:36 GMT
Content-Type: image/gif
X-Amz-Cf-Pop: JFK52-P10

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297s7JTH6MeeajvaG_V012JSDJZAFWCuzFeXGrYi-VZWVo
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Wed, 30 Oct 2024 14:08:36 GMT

POST
H2 200 ip.json Show response
api.company-target.com/api/v3/ 465 B
1019 B 671ms
234ms XHR
application/json 13.226.34.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&page_title=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/1469bf09af802378.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.34.79 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-34-79.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

ee98439c11ee9f2eaece7971d414049ec4089f484c21bef2c3145533592098ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: 467609bc-94f9-459c-9115-5599009d7e83
expires: Tue, 29 Oct 2024 14:08:36 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: 7ltVMZwJhnsUiBrQx2Rce85YxzqsGtDY0JLZ1i8uwt2c2n4f7-cfcA==
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 dd50f5bdd8da1cdd9e698cc2d6f8e828.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.humansecurity.com
x-amz-cf-pop: EWR53-C2
server: nginx

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 211ms
25ms Stylesheet
text/css 54.146.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-148-156.compute-1.amazonaws.com
Software: /
Resource Hash: 629dea3fc8ca3364508e787cddbe7e6a1e0e72071d9ba2ba4539a2c60c8f1dea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 226ms
38ms Fetch
image/jpeg 54.146.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-148-156.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: image/jpeg

GET
H/1.1 200
OK ns Show response
stk.px-cloud.net/ 352 B
486 B 410ms
31ms XHR
text/html 34.107.199.61
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://stk.px-cloud.net/ns?c=73f95380-96c8-11ef-9ce1-51cc9a8c43ca
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.107.199.61 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 61.199.107.34.bc.googleusercontent.com
Software: /
Resource Hash: a7ff04bcc70255b276f622fcc806efcaef74eb58c21f40873e769ba3b2c97467

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Access-Control-Allow-Origin: *
Content-Length: 352
Date: Wed, 30 Oct 2024 14:08:35 GMT
Content-Type: text/html

POST
H2 200 collector Show response
collector-pxf69i9fy8.px-cloud.net/api/v2/ 564 B
812 B 444ms
104ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxf69i9fy8.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 0c9ad84889a30b3f1c51e3d4973466afab9f95eeb1c5791ab7e2d3a29ac4916e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 564
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/json; charset=utf-8

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 90 KB
27 KB 266ms
90ms Script
application/javascript 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA==
cf-cache-status: DYNAMIC
etag: W/"006455bd44ed289ddcc403d0ecd96ab0"
age: 1564
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Wed, 30 Oct 2024 14:42:31 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 91778
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/javascript
last-modified: Thu, 16 May 2024 10:14:37 GMT
x-guploader-uploadid: AHmUCY2F7qAitBAOMseVL_8aKrYEfsuYkEodgLGkPe18Z_E3VyiiU_8XeZJmGncjd4s_WPoAAjJof9FydA
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
cf-ray: 8dabfa701dcb36ff-YYZ
x-goog-generation: 1715854477710382
server: cloudflare

GET
H3 200 / Show response
ws.zoominfo.com/pixel/650492e79cc5e659a2211991/ 3 KB
2 KB 256ms
227ms Fetch
text/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/650492e79cc5e659a2211991/?iszitag=true

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

c0b4eae57d5396c2444edf46c13b320be42336dae7d056dfefb771d5fc13680c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: 03aaf818d67b6e0f83a41730297314
_vtok: MTY3LjExNC4yMDkuMTAz
visited-url: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 8dabfa71ab38abbb-YYZ
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: text/javascript
vary: Accept-Encoding
x-powered-by: Express
server: cloudflare
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/650492e79cc5e659a2211991/ Frame 0
0 391ms
83ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/650492e79cc5e659a2211991/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.humansecurity.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8dabfa70e9857117-YYZ
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 30 Oct 2024 14:08:36 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H/1.1 200
OK ns Show response
stk.px-cloud.net/ 352 B
486 B 244ms
38ms XHR
text/html 34.107.199.61
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://stk.px-cloud.net/ns?c=741abe30-96c8-11ef-931e-1b264d76486e
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.107.199.61 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 61.199.107.34.bc.googleusercontent.com
Software: /
Resource Hash: 12b5425ac2374ea6adfc1782e8f5917982421a5df79f64da407225728ab36eb8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Access-Control-Allow-Origin: *
Content-Length: 352
Date: Wed, 30 Oct 2024 14:08:35 GMT
Content-Type: text/html

POST
H2 200 collector Show response
collector-pxxdhgmtcm.px-cloud.net/api/v2/ 564 B
812 B 198ms
97ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxdhgmtcm.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: b9bb4adeb25516fad94095a077d936a5f9ad05b52050b5b4f972ee96ddba6b3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 564
date: Wed, 30 Oct 2024 14:08:35 GMT
content-type: application/json; charset=utf-8

POST
H/1.1 200
OK visitWebPage
001-vjx-104.mktoresp.com/webevents/ 2 B
318 B 483ms
87ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://001-vjx-104.mktoresp.com/webevents/visitWebPage?_mchNc=1730297315933&_mchCn=&_mchId=001-VJX-104&_mchTk=_mch-humansecurity.com-1730297315910-86248&_mchHo=www.humansecurity.com&_mchPo=&_mchRu=%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

Transfer-Encoding: chunked
X-Request-Id: 3caba370-0e72-43da-8ee5-57564df5846b
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Wed, 30 Oct 2024 14:08:36 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202303.2.0/ 400 KB
97 KB 48ms
32ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe80b695a7ab94520475cee36f00b4439a2c76d6594c14797f5971d2b1036500

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: Sw59qQKTUz8IJh2hCY03KQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status: unlocked
cf-bgj: minify
cf-cache-status: HIT
x-ms-version: 2009-09-19
age: 14194
content-encoding: gzip
x-content-type-options: nosniff
cf-polished: origSize=409601
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: application/javascript
last-modified: Tue, 16 May 2023 03:39:51 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 78077915-a01e-0089-347d-252aae000000
cf-ray: 8dabfa70ec8da304-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 276 KB
97 KB 84ms
79ms Script
application/javascript 142.251.41.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-474QF6N3NS&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.8 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

fa4a4bb792839588fa1d1ebee266717634f14110146dc26d77b3e698eb1e39d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 30 Oct 2024 14:08:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99159
x-xss-protection: 0
server: Google Tag Manager

GET
H2 204 0
bat.bing.com/action/ 0
362 B 43ms
42ms Image
text/plain 2620:1ec:33:2::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=97050842&Ver=2&mid=01f776d3-7ce3-4b1c-be33-d437ac46216a&bo=1&sid=74439d2096c811efab152f3d2b21dfb7&vid=7443b5c096c811ef8cf041fa71e3a0c9&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&p=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&r=&lt=3133&evt=pageLoad&sv=1&cdb=AQAQ&rn=973012

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:2::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0EEC4E5BC92544F6A2952D8C5819BAB3 Ref B: CH1AA2020615025 Ref C: 2024-10-30T14:08:36Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Wed, 30 Oct 2024 14:08:35 GMT

POST
H2 204 view Show response
js.hs-banner.com/cookie-banner-public/v1/activity/ 0
174 B 66ms
65ms XHR
text/plain 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/cookie-banner-public/v1/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/3400937.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 604800
x-request-id: 914b7c31-a744-4677-87f6-e28c57b78bc4
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cf-cache-status: DYNAMIC
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
date: Wed, 30 Oct 2024 14:08:36 GMT
x-hubspot-correlation-id: 914b7c31-a744-4677-87f6-e28c57b78bc4
vary: origin
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-xlct6
timing-allow-origin: *
x-envoy-upstream-service-time: 17
access-control-allow-credentials: true
cf-ray: 8dabfa71fc1ea2d5-YUL
access-control-allow-origin: https://www.humansecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

OPTIONS
H2 200 view
js.hs-banner.com/cookie-banner-public/v1/activity/ Frame 0
0 94ms
50ms Preflight
application/octet-stream 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.humansecurity.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 8dabfa71aba0a2d5-YUL
content-length: 0
content-type: application/octet-stream
date: Wed, 30 Oct 2024 14:08:36 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 1
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-r8nlz
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 0be04aa2-6b4b-45c7-85e7-a6708c4e13ac
x-request-id: 0be04aa2-6b4b-45c7-85e7-a6708c4e13ac

GET
H2 200 widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame DC9F 0
0 67ms
27ms Document
text/html 151.101.44.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.humansecurity.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.44.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105429
content-type: text/html; charset=utf-8
date: Wed, 30 Oct 2024 14:08:36 GMT
etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
last-modified: Mon, 11 Dec 2023 17:19:49 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kiad7000164-IAD, cache-nyc-kteb1890032-NYC

HEAD
H2 200 main.min.js Show response
client.px-cloud.net/PXxDhGmtcm/ 0
0 0ms
0ms XHR
application/javascript 2600:141b:1c00:30::1739:5a6c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:30::1739:5a6c Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: max-age=600
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
content-encoding: gzip
etag: "369dc0777ecafe8aa85a233c99aef375"
active-cdn: Akamai
expires: Wed, 30 Oct 2024 14:17:58 GMT
accept-ranges: bytes
access-control-allow-origin: *
x-goog-stored-content-length: 71362
content-length: 71362
date: Wed, 30 Oct 2024 14:08:35 GMT
last-modified: Wed, 30 Oct 2024 13:27:32 GMT
content-type: application/javascript; charset=utf-8
server: UploadServer
vary: Accept-Encoding

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 330 KB
110 KB 68ms
68ms Script
application/javascript 142.251.41.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-59DHKRCY6M&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KVP42DD

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.8 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

82b3a7174ae98da683cb04e50ed86410669835cd0b557f492e5095987e1264bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 30 Oct 2024 14:08:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 112077
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
421 B 114ms
59ms XHR
text/html 2600:9000:2511:1a00:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=7ltVMZwJhnsUiBrQx2Rce85YxzqsGtDY0JLZ1i8uwt2c2n4f7-cfcA==&api-version=v3
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/1469bf09af802378.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:1a00:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70602
x-cache: Error from cloudfront
x-amz-cf-id: DEHqHZwxNKzyCoHyQJXFnkTrn5-JGny813GkQ0CgYhzPEXFPr-pySg==
date: Wed, 30 Oct 2024 04:44:03 GMT
content-type: text/html
vary: accept-encoding
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
via: 1.1 ffc407ec9784e618feb8fc53384b80aa.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: JFK50-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 / Show response
content.hotjar.io/ 56 B
171 B 594ms
218ms XHR
application/json 63.33.121.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=3389720&gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.625495a901d247c3e8d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 63.33.121.64 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-33-121-64.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ce435a6c403aef521ab0e71fbcd1da1122dcc577eaddf06a848bca92c7126ddf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-max-age: 86400
access-control-allow-origin: *
content-length: 56
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: application/json

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 163 B
361 B 36ms
31ms XHR
text/plain 54.146.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=-dpn7vAs7ZeiRx2WE4D6Xw&is_js=true&landing_url=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&t=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&tip=sYm0MUmIhgaRuhHEfoJNL2d6lR8KJYzmno8rxPkHUDA&host=https%3A%2F%2Fwww.humansecurity.com&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQg4_uIuQYwAToEQiu0oEIEqgAIFQ.gcC%252FXxOcIqHjVYmA85XaURqsJpEJ4R5Le92ZCRyGnVQ&sa-user-id-v2=s%253AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo&sa-user-id=s%253A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%252FnUUdvQbtnS6E0OP2Fmz54
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-148-156.compute-1.amazonaws.com
Software: /
Resource Hash: 92fa42c3c5bfc1e32f2979bd396d1002de3f8fdd454a487839c83025a20511d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.humansecurity.com
content-length: 163
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 44 KB
4 KB 88ms
87ms Fetch
application/json 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

1274bb52feff24e5d53e0419178460c359db9d517b0a70513897080cac3bb920

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Authorization: bearer 3a88c8f1a27e4f0ec92016da0338ac
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"aea1-MvDcB06pANwGGtOJrRGl7dqG2Fk"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8dabfa76c8acabbb-YYZ
access-control-allow-origin: https://www.humansecurity.com
x-powered-by: Express
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/97406b3a-009d-4b48-bad5-1eb21c564b7d/ 69 KB
14 KB 38ms
38ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/10c1c946-3ec8-49a0-92ce-5be53945f2bc/97406b3a-009d-4b48-bad5-1eb21c564b7d/en.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd27193574494c7c28903f1088f7eba26bf7c29f814e711e006036e733ceef8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: PdTtH04dK1QUPBi2biFoKg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DB817651F13E61
age: 46917
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 31 Oct 2024 14:08:36 GMT
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: application/json
last-modified: Mon, 10 Jul 2023 18:48:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: d2ad6b3e-301e-0062-764d-26d452000000
cf-ray: 8dabfa75ffe5a322-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14570
x-ms-blob-type: BlockBlob
server: cloudflare

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 133ms
133ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.humansecurity.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8dabfa75ed737117-YYZ
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 30 Oct 2024 14:08:36 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 42ms
41ms Fetch
text/plain 142.250.80.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-474QF6N3NS&gtm=45je4as0v9124658847za200&_p=1730297313220&gcs=G1--&gcd=13l3l3l3l6l1&npa=0&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&ul=en-ca&sr=1600x1200&cid=1371297405.1730297315&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&sid=1730297316&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_1=1371297405.1730297315&ep.ua_dimension_2=Human&tfd=4850
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.78 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s35-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.humansecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
analytics.google.com/g/ 0
0 173ms
41ms Fetch
text/plain 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-59DHKRCY6M&gtm=45je4as0v881684866z8830094232za200zb830094232&_p=1730297313220&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&cid=GA1.2.1371297405.1730297315&ul=en-ca&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1730297316&sct=1&seg=0&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&en=page_view&_fv=1&_ss=1&ep.timestamp=2024-10-30T07%3A08%3A36.628-07%3A00&ep.db_audience=Residential&ep.db_audience_segment=&tfd=4990
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80d::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.humansecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
269 B 44ms
39ms Ping
text/plain 2607:f8b0:4004:c09::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-59DHKRCY6M&cid=GA1.2.1371297405.1730297315&gtm=45je4as0v881684866z8830094232za200zb830094232&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-59DHKRCY6M&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c09::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.humansecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame E9B9 0
0 51ms
50ms Document
text/html 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-59DHKRCY6M&gacid=GA1.2.1371297405.1730297315&gtm=45je4as0v881684866z8830094232za200zb830094232&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629&z=2038698820

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-59DHKRCY6M&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Oct 2024 14:08:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 399ms
397ms Image
image/gif 142.251.32.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-59DHKRCY6M&cid=GA1.2.1371297405.1730297315&gtm=45je4as0v881684866z8830094232za200zb830094232&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629&tag_exp=101533422~101823848~101878899~101878944~101925629&z=1549608780

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.99 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 30 Oct 2024 14:08:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202303.2.0/assets/v2/ 61 KB
13 KB 33ms
32ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.2.0/assets/v2/otPcCenter.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: obw5M94dAr0Gi2p2lbQQ/g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB55BF32AEE4B7
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 63522
x-content-type-options: nosniff
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: application/json
last-modified: Tue, 16 May 2023 03:39:48 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d6f8cc22-301e-0069-7468-7900cf000000
cf-ray: 8dabfa783a7fa322-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12544
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202303.2.0/assets/ 21 KB
4 KB 34ms
32ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.2.0/assets/otCommonStyles.css

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c013d90ee202f7f0c56e4d0cacea4332b8437b6be5c25e5a449ca5ac6b0752e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: oWkBTLgDDXvrUsd93y/Zxg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status: unlocked
cf-bgj: minify
cf-cache-status: HIT
x-ms-version: 2009-09-19
age: 14894
content-encoding: gzip
x-content-type-options: nosniff
cf-polished: origSize=21608
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: text/css
last-modified: Tue, 16 May 2023 03:39:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: c12036af-201e-0093-6a87-cd05c1000000
cf-ray: 8dabfa783a83a322-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
489 B 152ms
118ms Fetch
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: image/svg+xml
last-modified: Tue, 29 Oct 2024 16:01:48 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 3d11096b-201e-0054-507b-2a7900000000
cf-ray: 8dabfa78db3aa322-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 HUMAN_logo_horiz_black.jpg
cdn.cookielaw.org/logos/bdc406fe-f273-4909-9374-53fa72f05678/73a6679b-4f30-4bde-8d8b-9f140d71ffc3/ec625dd3-e584-4556-aaae-79e3c80ba85a/ 108 KB
108 KB 36ms
22ms Image
image/jpeg 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/bdc406fe-f273-4909-9374-53fa72f05678/73a6679b-4f30-4bde-8d8b-9f140d71ffc3/ec625dd3-e584-4556-aaae-79e3c80ba85a/HUMAN_logo_horiz_black.jpg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31bffb649cd812a3e720b1838c910fe359aef60c46ec91149d895dc23708768d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: NhqNgvFSsXYG+FRFrroJLA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status: unlocked
cf-bgj: h2pri
etag: 0x8DB815798A1C292
x-ms-version: 2009-09-19
cf-cache-status: HIT
age: 63522
x-content-type-options: nosniff
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: image/jpeg
last-modified: Mon, 10 Jul 2023 15:09:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 9b7a268c-301e-001b-6e73-790780000000
cf-ray: 8dabfa78d8c3a304-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 110133
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 36ms
20ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 52489
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: image/svg+xml
last-modified: Tue, 29 Oct 2024 16:01:49 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 0e0da7bd-401e-006d-7727-2a39a4000000
cf-ray: 8dabfa78d8c4a304-YUL
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET undefined
www.humansecurity.com/learn/blog/ 0
0

GET
H3 200 footer.min.css
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115387395449/1693233183077/humansecurity-hs/assets/css/ 21 KB
4 KB 133ms
88ms Stylesheet
text/css 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115387395449/1693233183077/humansecurity-hs/assets/css/footer.min.css
Requested by: Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115307132989/1698698445616/humansecurity-hs/punch/assets/js/lazy-loading.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46043be637afe914e3a575c2921cd2904b2c4b59388128ed10625628402d46a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 76b0ec2b-4aed-46a4-b325-17ff085f6fdc
content-encoding: gzip
cf-cache-status: HIT
etag: W/"b4d88ed60cd8e0f1e827de88fcfcc1e8"
age: 271498
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q9wX78bRZcPGO4t232VI1jH5jyaBtj%2Bsh13DKXXJ6pRdFr1XdIhGsmvQnWgK4FMda4BO8%2F0XFl4%2FYsR8uNo5CJajro6DcInDv5Aptk%2BfrhcJHr66RKA0oNJScpucbJWLnuE%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 76b0ec2b-4aed-46a4-b325-17ff085f6fdc
content-type: text/css
last-modified: Mon, 28 Aug 2023 14:33:04 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
x-envoy-upstream-service-time: 313
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:37 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8dabfa794a2139f6-YYZ
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1693233183807

POST
H2 200 collector Show response
collector-pxxdhgmtcm.px-cloud.net/api/v2/ 600 B
655 B 129ms
125ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxdhgmtcm.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 5fcb888878533ed353b205745289b5de86181e47a1184c0ae32406d39ff06af0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
date: Wed, 30 Oct 2024 14:08:36 GMT
content-type: application/json; charset=utf-8

POST
H2 200 collector Show response
collector-pxf69i9fy8.px-cloud.net/api/v2/ 116 B
171 B 120ms
115ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxf69i9fy8.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 3fc25f32376add5872f8820fe0ac2ad8e3f7f11d798a7547ea5b813a45f1e717

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 116
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: application/json; charset=utf-8

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
611 B 82ms
64ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-ca&bfp=2919926434&v=1.1&a=3400937&pi=172757353219&ct=blog-post&ccu=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&cpi=172757353219&cgi=5249379964&lpi=172757353219&lvi=172757353219&lvc=en-us&pu=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&t=Satori+Threat+Intelligence+Alert%3A+Konfety+Spreads+%E2%80%98Evil+Twin%E2%80%99+Apps+for+Multiple+Fraud+Schemes&cts=1730297317515&vi=0e85f6c77541f42fe43a80249b3d848e&nc=true&ce=false&pt=1&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
x-request-id: f65c3bf0-c9c0-43f2-822b-351f14ae66f6
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z1khNhbIKzn7PIxrlYpSgoavbWi8bIVZjrBSSpSqP17b0vQcNUcLegRfKCaH1XOVUYNg64za3BSRQbUZ7f%2FG6Xt91rrtIksRLU3KAaACN6%2B0fH8IVmwc6SJx2LI9kfQ2OkpDQSXM1dMno%2FBH0fBq"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Wed, 30 Oct 2024 14:08:37 GMT
x-hubspot-correlation-id: f65c3bf0-c9c0-43f2-822b-351f14ae66f6
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-746d57b5c6-4rf6n
x-envoy-upstream-service-time: 6
access-control-allow-credentials: false
cf-ray: 8dabfa7aaf3d714a-YUL
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
BLOB 200
OK 99c2ea42-3917-415d-a558-100481c329b6 Show response
https://www.humansecurity.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.humansecurity.com/99c2ea42-3917-415d-a558-100481c329b6
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0b4eae57d5396c2444edf46c13b320be42336dae7d056dfefb771d5fc13680c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/javascript
Content-Length: 3033

GET
H3 200 collect
www.google-analytics.com/ 35 B
58 B 26ms
25ms Image
image/gif 142.250.80.78
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=417258359&t=timing&_s=2&dl=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&ul=en-ca&de=UTF-8&dt=Satori%20Threat%20Intelligence%20Alert%3A%20Konfety%20Spreads%20%E2%80%98Evil%20Twin%E2%80%99%20Apps%20for%20Multiple%20Fraud%20Schemes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=5501&pdt=90&dns=58&rrt=1&srt=295&tcp=165&dit=2708&clt=3131&_gst=1592&_gbt=3263&_u=aHDAgEABAAAAAGAEK~&jid=&gjid=&cid=1371297405.1730297315&tid=UA-111948466-2&_gid=976550459.1730297315&gtm=45He4as0n81KVP42DDv830094232za200&cd7=2024-10-30T07%3A08%3A33.594-07%3A00&cd8=f3558ec1-e37c-43b8-bc96-68c8bd3aea99&gcs=G1--&gcd=13l3l3l3l5l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&cd3=1371297405.1730297315&z=159905647

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

age: 62556
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:46:01 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H3 200 Human-Favicon-White-Black%20BKG.png
www.humansecurity.com/hubfs/ 10 KB
11 KB 54ms
52ms Other
image/webp 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.humansecurity.com/hubfs/Human-Favicon-White-Black%20BKG.png

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

efa303262b36a12c1c28503edc4d8852388482855d729b169c9bfb1b969adf45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-robots-tag: none
cf-cache-status: HIT
etag: "90f1b1e31f9d8f952a7c9f1b72a4fad6"
age: 527438
cache-tag: F-84331736107,P-3400937,FLS-ALL
x-amz-version-id: AKHQlYFHnOtKub5LKdbjtfvMhkFcjFo4
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BFbdNTEtd2Bcr1zV0f3qZCs%2Bc9uHwDxrv8Vkf9kyHRM13YmXlnbip%2FXR6EJbLBLigisdl8bDDiHupBiSH%2Bk3C4OoRGt9y8gLQfZeK4AOeUG3So9dhM7Gua4aDsuiIju1btblm80C6w%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: fjHL1UmjP8qqE3VggpOEa_wuENPbm9PibzFQcx1ejGZ-FZnHx6h24w==
content-type: image/webp
content-disposition: inline; filename="Human-Favicon-White-Black%20BKG.webp"
last-modified: Fri, 27 Sep 2024 14:22:44 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-84331736107,P-3400937,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: WTNJDM91PETQTDCJ
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-84331736107,P-3400937,FLS-ALL
content-length: 10100
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: origFmt=png, origSize=35632
date: Wed, 30 Oct 2024 14:08:37 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: DVXfNSPScDDWp0m4oFyu6xkSl1zGKQF2xV6jWHxvueyNNGzr6Z0FJfXIAWExq8iy48XJMFt5PLQwH/w5wrYzZw==
strict-transport-security: max-age=31536000
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 1bffd64b2a2fa20ecc97fd2f8e605ec4.cloudfront.net (CloudFront)
cf-ray: 8dabfa7acf90a1ff-YYZ
access-control-allow-origin: *
x-amz-cf-pop: YUL62-P2
x-amz-meta-created-unix-time-millis: 1662646750288

POST
H3 200 collector Show response
collector-pxxdhgmtcm.px-cloud.net/api/v2/ 32 B
49 B 121ms
113ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxdhgmtcm.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: da6268d3e4ffd8edd34230feca29fa5a83e1562bd9cf623c05737ec3eea36871

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
date: Wed, 30 Oct 2024 14:08:38 GMT
content-type: application/json; charset=utf-8

POST
H3 200 collector Show response
collector-pxf69i9fy8.px-cloud.net/api/v2/ 116 B
134 B 91ms
89ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxf69i9fy8.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 916fce4bfe6915036ce461600bb31fd4b3c7f9970141b92f27caa76f3daace6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 116
date: Wed, 30 Oct 2024 14:08:37 GMT
content-type: application/json; charset=utf-8

POST
H3 200 collector Show response
collector-pxxdhgmtcm.px-cloud.net/api/v2/ 600 B
618 B 132ms
129ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxdhgmtcm.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 0ccf743ea23f8bfed4a265908dd3a82e7710d144b93a4a52ef189a98f1e97c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
date: Wed, 30 Oct 2024 14:08:38 GMT
content-type: application/json; charset=utf-8

GET
H2 200 fullcircle.js Show response
d2i34c80a0ftze.cloudfront.net/ 32 KB
11 KB 105ms
34ms Script
application/json 2600:9000:28b2:7000:9:14eb:6280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=c05754bf-2b15-4935-b7c4-cf576218c528&domain=humansecurity.com

Requested by

Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:28b2:7000:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

88e7b0718f584603ca29ed368567c07f629f1012e0e4972c3fd95db2e339504d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-amz-apigw-id: Aa_edHq0vHcEBHw=
age: 76581
x-amzn-trace-id: Root=1-672112c2-29272e9d42a8c69476416957;Parent=46a89b24fc80b824;Sampled=0;Lineage=1:be50798f:0
x-amzn-requestid: 6cd8248a-6900-44b1-91c8-df0dd2c0e3ee
via: 1.1 87e02820e63ff6cf9cd98d9efbaab1fc.cloudfront.net (CloudFront), 1.1 645b3b9307ff6780fc1a76b712bc5728.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: OwcaiVFRSfPUfOx8WOj417ODEHEK6x1HjbXxyi1rmSrK8H90A78WGQ==
date: Tue, 29 Oct 2024 16:52:18 GMT
content-type: application/json
x-amz-cf-pop: IAD55-P5, JFK52-P8
vary: Accept-Encoding

GET
H2 200 app.js Show response
acsbapp.com/apps/app/dist/js/ 382 KB
115 KB 220ms
168ms Script
application/javascript 2606:4700:10::ac43:b9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://acsbapp.com/apps/app/dist/js/app.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b9b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d15f7c19eab921bdd46cf2f29ed0063cd830bca3997c7ee5a241429fe72f6b0d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=f3O64Q==, md5=tecEUw0lsvtId0GjtDGnbA==
cf-cache-status: REVALIDATED
etag: W/"b5e704530d25b2fb487741a3b431a76c"
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Thu, 30 Oct 2025 14:08:39 GMT
x-goog-stored-content-length: 390823
date: Wed, 30 Oct 2024 14:08:39 GMT
content-type: application/javascript
last-modified: Wed, 30 Oct 2024 11:01:27 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY1FPnJh3H--sELa5WRLNnqhaG8NSaAieMCNLasCe0VhfoKaFqVxCWWTrVQOHBSC1HPG9zo
cache-control: public, max-age=300, must-revalidate
x-goog-storage-class: STANDARD
cf-ray: 8dabfa859b30a2ec-YUL
access-control-allow-origin: *
x-goog-generation: 1730286087200924
server: cloudflare

GET
H3 200 body.min.css
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/99901597287/1721248587601/humansecurity-hs/assets/css/ 133 KB
21 KB 54ms
51ms Stylesheet
text/css 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/99901597287/1721248587601/humansecurity-hs/assets/css/body.min.css
Requested by: Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115307132989/1698698445616/humansecurity-hs/punch/assets/js/lazy-loading.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1892bc981117777e575dc1231631c473cc8b57fd0d023c5e883978d5256a85ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 791e99e9-7407-427a-af89-adc15e855015
content-encoding: gzip
cf-cache-status: HIT
etag: W/"133efba53ade4b7f1ba3a07bcea5eca9"
age: 1268322
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qrbEuDLfyTrErFnXdM5kucHWDpOOLKQNCsenk0lnQ2dlkK3%2Bizi6PxO0h6X%2B3YychMz0W5z3pxafo4xKMBM74XOyd5E7UhQ369%2FOO96trTNTZ8nmmg7DK3tRfCMfXOgp9B4%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 791e99e9-7407-427a-af89-adc15e855015
content-type: text/css
last-modified: Wed, 17 Jul 2024 20:36:29 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7bc58b7fb6-9fg76
x-envoy-upstream-service-time: 179
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:39 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8dabfa855b2139f6-YYZ
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1721248588873

GET
H3 200 jquery.magnificpopup.min.js Show response
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656499996/1698698454228/humansecurity-hs/punch/assets/js/dist/ 20 KB
9 KB 103ms
100ms Script
application/javascript 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656499996/1698698454228/humansecurity-hs/punch/assets/js/dist/jquery.magnificpopup.min.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a123eebd3f1e4f9b4641216ddc8aee3dd0ecc035cc9d2f6ed7b92c979fccc326

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: d117c4ea-09ae-4825-9156-158764a86ef8
content-encoding: br
cf-cache-status: HIT
etag: W/"23546b2633cc3b557bb3a13ac0d1c719"
age: 2070312
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p3NeOubcGph6aogGpVOOdTy%2FERrBiAkFrM66X14UFNQUKU5ADPeGemnzaZulv9GDw7TaJFQFOZ0NI5UeCRrgqWNJ9BzroK7WUSOxh%2FdxF%2FcKmHHEyp5PCtJU1jN0TlGc1lU%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: d117c4ea-09ae-4825-9156-158764a86ef8
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:55 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-qd96f
x-envoy-upstream-service-time: 250
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:39 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8dabfa855b2239f6-YYZ
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698454685

GET
H3 200 lightbox-combo.min.js Show response
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115294898870/1698698465768/humansecurity-hs/punch/assets/js/dist/ 24 KB
10 KB 125ms
123ms Script
application/javascript 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/115294898870/1698698465768/humansecurity-hs/punch/assets/js/dist/lightbox-combo.min.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54922aed651f983596d7c4d47b075f10dfa004fffe6c60c15c59ecdc1856529f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: dc6a0cdb-bd75-43a4-a9f9-4fd2db7504a3
content-encoding: br
cf-cache-status: HIT
etag: W/"687a6f388e56976362f732fa3410027c"
age: 1174460
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zdUTCQCloO4RkQN1V392QstKbgqyteRvwIEQbBIvSYCWrjAIzUTOajAYEFqUQ7IQwTu%2FdVKEA20fLfqgza0306%2BaFdaFYSjyr9Zwdtqymm2Q6AVvfDevWz%2B7rgyDC1L%2FfQA%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: dc6a0cdb-bd75-43a4-a9f9-4fd2db7504a3
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:41:07 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-4f62g
x-envoy-upstream-service-time: 132
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:39 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8dabfa855b2339f6-YYZ
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698466182

GET
H3 200 flickity-combo.min.js Show response
cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656625716/1698698450031/humansecurity-hs/punch/assets/js/dist/ 67 KB
19 KB 219ms
216ms Script
application/javascript 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3400937/hub_generated/template_assets/63656625716/1698698450031/humansecurity-hs/punch/assets/js/dist/flickity-combo.min.js
Requested by: Host: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d3b1eb7d0f0f9f6b02dc4d100a34d5ed61b9b22e284ef8b8fc16dee56cb0453

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

x-request-id: 9f1ac9b8-dd69-495c-b5d8-0380d7cd9e61
content-encoding: br
cf-cache-status: HIT
etag: W/"0b1204d9265290f1b3d4250e491d06dd"
age: 260147
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p95Bmy5jZ%2F5u5Ant4SoC%2FDUBZgyy3LWOiyzSTNNEuUTnm3sLjtX7aA1Wuqq6fIPmgrOOHqDciQUuBNK7s9CnjmuzJ1YtsoOfBsnKwzv8mlpRcvgRRQiZbhr3RtjR7vWeRfo%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 9f1ac9b8-dd69-495c-b5d8-0380d7cd9e61
content-type: application/javascript; charset=utf-8
last-modified: Mon, 30 Oct 2023 20:40:51 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
x-envoy-upstream-service-time: 228
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Wed, 30 Oct 2024 14:08:39 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8dabfa855b2439f6-YYZ
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1698698450553

POST
H2 200 create Show response
st.fullcircleinsights.com/v1/visitors/ 1 KB
2 KB 285ms
282ms XHR
application/json 18.164.96.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://st.fullcircleinsights.com/v1/visitors/create

Requested by

Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=c05754bf-2b15-4935-b7c4-cf576218c528&domain=humansecurity.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.18 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-18.jfk50.r.cloudfront.net

Software

Resource Hash

660b03bf4238e7c9c02a55d0ccfbb6ad3362ecba8c247670b43a6fb5a7b85d82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
js-version: 1.0.59
x-api-key: zCJpG9ai2q4CdEz1TtZtE8XZaM9NCVR329XSil6T
origin-fci: https://www.humansecurity.com

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-amz-apigw-id: Ad6cTGA0vHcEGlQ=
x-amzn-trace-id: Root=1-67223de7-58fe56ac354df8a55243f8b3;Parent=7658dac761edd812;Sampled=0;Lineage=1:7c392b7c:0
x-amzn-requestid: aa9db2fd-e5fe-41fa-b728-ad1d31acf55d
via: 1.1 c50e3f7de0b772d07240015272b1aff6.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.humansecurity.com
x-cache: Miss from cloudfront
content-length: 1491
x-amz-cf-id: gCVxxYoY1Ecwt9cdu7uLZvvob2xQNFAFNh4xo38qF8PHX29vQmQ2TA==
date: Wed, 30 Oct 2024 14:08:40 GMT
content-type: application/json
vary: Origin
x-amz-cf-pop: JFK50-P5

OPTIONS
H2 200 create
st.fullcircleinsights.com/v1/visitors/ Frame 0
0 452ms
209ms Preflight
application/json 18.164.96.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-18.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: js-version,origin-fci,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.humansecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: https://www.humansecurity.com
content-length: 1
content-type: application/json
date: Wed, 30 Oct 2024 14:08:39 GMT
via: 1.1 c50e3f7de0b772d07240015272b1aff6.cloudfront.net (CloudFront)
x-amz-apigw-id: Ad6cRH3NvHcEeTg=
x-amz-cf-id: APsbq5Tmf5uqlxpEb-3c62ZZzCxaRi2kTT1JIbUiYiwWl1LEjj0qhA==
x-amz-cf-pop: JFK50-P5
x-amzn-requestid: da37db5b-4bfe-4ca2-b7b6-b817770663d7
x-cache: Miss from cloudfront

GET config.json
cdn.acsbapp.com/config/humansecurity.com/ 0
0

OPTIONS queue
st.fullcircleinsights.com/v1/visits/ Frame 0
0

POST queue
st.fullcircleinsights.com/v1/visits/ 0
0

POST
H3 200 collector Show response
collector-pxf69i9fy8.px-cloud.net/api/v2/ 116 B
134 B 83ms
81ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxf69i9fy8.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXf69I9fY8/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: b232e9ea2760df045a59fd0db5eb70254c81b5820c4bb19f009102bcdf12d61a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 116
date: Wed, 30 Oct 2024 14:08:41 GMT
content-type: application/json; charset=utf-8

POST
H3 200 collector Show response
collector-pxxdhgmtcm.px-cloud.net/api/v2/ 32 B
49 B 92ms
90ms XHR
application/json 35.190.10.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-pxxdhgmtcm.px-cloud.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PXxDhGmtcm/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.10.190.35.bc.googleusercontent.com
Software: /
Resource Hash: da6268d3e4ffd8edd34230feca29fa5a83e1562bd9cf623c05737ec3eea36871

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Response headers

timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
via: 1.1 google
access-control-allow-origin: https://www.humansecurity.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
date: Wed, 30 Oct 2024 14:08:41 GMT
content-type: application/json; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.humansecurity.com
URL: https://www.humansecurity.com/learn/blog/undefined

Domain: cdn.acsbapp.com
URL: https://cdn.acsbapp.com/config/humansecurity.com/config.json?page=%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes

Domain: st.fullcircleinsights.com
URL: https://st.fullcircleinsights.com/v1/visits/queue

Domain: st.fullcircleinsights.com
URL: https://st.fullcircleinsights.com/v1/visits/queue

Verdicts & Comments Add Verdict or Comment

149 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

55 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.humansecurity.com/	1970-01-21 00:38:19	Name: __cf_bm Value: nOf.m4.4C3Q_bcfFXU7WKJ5jKM1nnxpdsKNJmCFBvaM-1730297312-1.0.1.1-eftJuaVf2QUx11FCmJ0aPlvD7AISVJEdPjZZ3NFvyVrK5DzozdOikCtMUPk.WJlga8gtC1It9rgljjXFEsLmag
.www.humansecurity.com/	1969-12-31 23:59:59	Name: __cfruid Value: f001dbea685ec79005332bc227defced9ed5304f-1730297312
.humansecurity.com/	1970-01-21 02:47:53	Name: _gcl_au Value: 1.1.1303771909.1730297314
.g2crowd.com/	1970-01-21 00:38:19	Name: __cf_bm Value: nEGweZW9qw9olhu9fQmpxCp0el_aUiqaFbWTx7WjwDE-1730297314-1.0.1.1-0rH6ZsLjFa1q0hH8pCHTpkyqKBXVzJX5eoBziYLy57NcQHI8YXwycz1rlNVB1l7m7To84dC6XdzQNmU5c9pONw
tags.srv.stackadapt.com/	1970-01-21 09:23:53	Name: sa-user-id Value: s%3A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%2FnUUdvQbtnS6E0OP2Fmz54
.srv.stackadapt.com/	1970-01-21 09:23:53	Name: sa-user-id Value: s%3A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%2FnUUdvQbtnS6E0OP2Fmz54
tags.srv.stackadapt.com/	1970-01-21 09:23:53	Name: sa-user-id-v2 Value: s%3AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
.srv.stackadapt.com/	1970-01-21 09:23:53	Name: sa-user-id-v2 Value: s%3AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
tags.srv.stackadapt.com/	1970-01-21 09:23:53	Name: sa-user-id-v3 Value: s%3AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQg4_uIuQYwAToEQiu0oEIEqgAIFQ.gcC%2FXxOcIqHjVYmA85XaURqsJpEJ4R5Le92ZCRyGnVQ
.srv.stackadapt.com/	1970-01-21 09:23:53	Name: sa-user-id-v3 Value: s%3AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQg4_uIuQYwAToEQiu0oEIEqgAIFQ.gcC%2FXxOcIqHjVYmA85XaURqsJpEJ4R5Le92ZCRyGnVQ
.humansecurity.com/	1970-01-21 00:39:43	Name: _gid Value: GA1.2.976550459.1730297315
.humansecurity.com/	1970-01-21 00:38:17	Name: _dc_gtm_UA-111948466-2 Value: 1
.humansecurity.com/	1970-01-21 00:38:17	Name: _gat_UA-111948466-3 Value: 1
www.humansecurity.com/	1970-01-21 09:23:53	Name: sa-user-id Value: s%253A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%252FnUUdvQbtnS6E0OP2Fmz54
www.humansecurity.com/	1970-01-21 09:23:53	Name: sa-user-id-v2 Value: s%253AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
www.humansecurity.com/	1970-01-21 09:23:53	Name: sa-user-id-v3 Value: s%253AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQg4_uIuQYwAToEQiu0oEIEqgAIFQ.gcC%252FXxOcIqHjVYmA85XaURqsJpEJ4R5Le92ZCRyGnVQ
.www.humansecurity.com/	1970-01-21 09:23:53	Name: _zitok Value: 03aaf818d67b6e0f83a41730297314
.linkedin.com/	1970-01-21 00:39:43	Name: lidc Value: "b=TGST01:s=T:r=T:a=T:p=T:g=3454:u=1:x=1:i=1730297315:t=1730383715:v=2:sig=AQH3DCPcmke0b-rw6NTblhwucHFZjxiv"
.hubspot.com/	1970-01-21 00:38:19	Name: __cf_bm Value: kp5N3lVKPyDA8dhqKyn64dWDA7dWVW8cXRWErdfNJH0-1730297315-1.0.1.1-VvbhHoH6ajvhzxOoRLLiUhlWoYMFVIdHNXaeQgUnvozrxhnAR7gvIafuvglRcVRfo25wfb8ddol84UzaHM4FHw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: JV_ialNKjpK8hZtB_kLD6u2F3Wz0CSEa7tO7gvXjUx4-1730297315740-0.0.1.1-604800000
.linkedin.com/	1970-01-21 09:23:53	Name: bcookie Value: "v=2&a222bde6-bfda-4555-8225-2e6ec82ff5ee"
.linkedin.com/	1970-01-21 04:57:29	Name: li_gc Value: MTswOzE3MzAyOTczMTU7MjswMjFir9hVrpjM3OFKyMgb1oI1mWLwE4ByTVoD7C5IcDPpew==
.company-target.com/	1970-01-21 10:14:17	Name: tuuid Value: e0fa0dde-df55-41d9-be40-038d33d90f17
.company-target.com/	1970-01-21 10:14:17	Name: tuuid_lu Value: 1730297315\|ix:0\|mctv:0\|rp:0
.humansecurity.com/	1970-01-21 10:14:17	Name: _mkto_trk Value: id:001-VJX-104&token:_mch-humansecurity.com-1730297315910-86248
.zoominfo.com/	1970-01-21 00:38:19	Name: __cf_bm Value: jirtu8RFSFTECaGCw6r3WhipVnPzeL_saWHfV5k68iY-1730297315-1.0.1.1-JmHBtbd3SDkcCjNr0tGDQ25gHqvTbyMEcRvw5CQQvTRd4QBYhoZu8.htkhgvVHGd6x3fQgS_w7BRmSMpaosRsg
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 67FiaevP0shnt4RqxwVxeUBb669RIfIj7EEbS2qSE9w-1730297315875-0.0.1.1-604800000
.humansecurity.com/	1970-01-21 00:39:43	Name: _uetsid Value: 74439d2096c811efab152f3d2b21dfb7
.humansecurity.com/	1970-01-21 09:59:53	Name: _uetvid Value: 7443b5c096c811ef8cf041fa71e3a0c9
.rlcdn.com/	1970-01-21 09:23:53	Name: rlas3 Value: 1oBKeHqPR5a40dTlL2wzIz1MgArMRepNWQHbs54eaBg=
.rlcdn.com/	1970-01-21 02:04:41	Name: pxrc Value: COT7iLkGEgUI6AcQABIGCMrdKhAA
.bing.com/	1970-01-21 09:59:53	Name: MUID Value: 1D24E169D33E6FDE1531F441D2ED6EC6
.bat.bing.com/	1970-01-21 00:48:22	Name: MR Value: 0
.casalemedia.com/	1970-01-21 09:23:53	Name: CMID Value: ZyI95NHM6uYAAAzIAF5arAAA
.casalemedia.com/	1970-01-21 02:47:53	Name: CMPS Value: 3868
.casalemedia.com/	1970-01-21 02:47:53	Name: CMPRO Value: 3868
.tremorhub.com/	1970-01-21 09:24:14	Name: tvid Value: 2e990bad5378448583b147670b523bbf
.tremorhub.com/	1970-01-21 10:14:17	Name: tv_UIDM Value: e0fa0dde-df55-41d9-be40-038d33d90f17
.rubiconproject.com/	1970-01-21 09:23:53	Name: audit_p Value: 1\|39O9bsLZGDRXqgzsJoFaSb/8onkBTaqHzrsgdGKqVHc7wCFCn6f3elq/mvySx1ihXiSmPEH78S0wHTRO1/p4iJLoYn4tEwhGrFmDvSSwx/uddFfAXh/SC6I8+zq1mb72FkOUoWc5RZtYCPJABG1P2nPpbBbWwXfCVFGxpdJGiDeWvEnWSmTsitzpQ7vzkXQ/
.rubiconproject.com/	1970-01-21 09:23:53	Name: khaos Value: M2VYCHSN-27-KNHH
.rubiconproject.com/	1970-01-21 09:23:53	Name: khaos_p Value: M2VYCHSN-27-KNHH
.rubiconproject.com/	1970-01-21 09:23:53	Name: audit Value: 1\|39O9bsLZGDRXqgzsJoFaSb/8onkBTaqHzrsgdGKqVHc7wCFCn6f3elq/mvySx1ihXiSmPEH78S0wHTRO1/p4iJLoYn4tEwhGrFmDvSSwx/uddFfAXh/SC6I8+zq1mb72FkOUoWc5RZtYCPJABG1P2nPpbBbWwXfCVFGxpdJGiDeWvEnWSmTsitzpQ7vzkXQ/
.rubiconproject.com/	1970-01-21 02:47:53	Name: receive-cookie-deprecation Value: 1
.humansecurity.com/	1970-01-21 09:23:53	Name: _hjSessionUser_3389720 Value: eyJpZCI6IjVmMmUwYWVjLTgxNTYtNTAwZi04ZWZkLTkwZDJjNDAyMWI5MCIsImNyZWF0ZWQiOjE3MzAyOTczMTYyMjQsImV4aXN0aW5nIjp0cnVlfQ==
.humansecurity.com/	1970-01-21 00:38:19	Name: _hjSession_3389720 Value: eyJpZCI6ImUxN2E1ZWJiLWM2NjUtNGVkZS1iMDk1LTVjOTFmNmUwNTIzNSIsImMiOjE3MzAyOTczMTYyMzAsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.humansecurity.com/	1969-12-31 23:59:59	Name: pxcts Value: 74467839-96c8-11ef-8b87-d60a1ff054c9
.humansecurity.com/	1970-01-21 09:23:53	Name: _pxvid Value: 744661fc-96c8-11ef-8b85-32489b2fee54
www.humansecurity.com/	1969-12-31 23:59:59	Name: pxcts Value: 7446d21e-96c8-11ef-ad16-b212af20c74c
.humansecurity.com/	1970-01-21 10:14:17	Name: _ga_474QF6N3NS Value: GS1.2.1730297316.1.0.1730297316.0.0.0
.humansecurity.com/	1970-01-21 10:14:17	Name: _ga_59DHKRCY6M Value: GS1.1.1730297316.1.0.1730297316.60.0.0
.humansecurity.com/	1970-01-21 10:14:17	Name: _ga Value: GA1.1.GA1.2.1371297405.1730297315
.doubleclick.net/	1970-01-21 10:14:17	Name: IDE Value: AHWqTUnmfLF9ayv6_LG9q5OlFW5OFfYZm8ne8PuyoqzrRuPDIsstD56XXPvLZfMP
.www.humansecurity.com/	1970-01-21 09:23:53	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Oct+30+2024+07%3A08%3A37+GMT-0700+(Pacific+Daylight+Time)&version=202303.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.humansecurity.com%2Flearn%2Fblog%2Fsatori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes&groups=C0001%3A1%2CC0003%3A1%2CSPD_BG%3A1%2CC0004%3A1%2CC0002%3A1
.humansecurity.com/	1970-01-21 00:38:17	Name: _px3 Value: daf4ff78291fab297a3d91c33536ad211e7582b6d29dae75f825e3f002ce89ac:GPnY4P5t9krzMb58Z+KBKhQWo9rU6riWOfbadSJuit2zlcGl/F8Y+jn2W/0cSJkK341LpdXfmmPhBUsgz31fxw==:1000:xeDlAj98AOoB7K8x6afDbKxLioZF4AWwcoTPHsKiCPfUJgDx0sp9/GX0UJqa2C+6KiqYTRUj28f4jsRFSVIY9wOZmG8VOadZbjXuNMQIcDJpHwvocjeTyT5GvVZOhh54ZzqbsNdI7VmIb+zoLSigl8IyXrhBorGrs7cXPSlUVJSd6J51BpZc6Lc65RTLrlxNXwntmGxvCJ+JHSKLEuUMsRw1f1Djg/qDBL7PjW12gTI=
.humansecurity.com/	1969-12-31 23:59:59	Name: _fcdscst Value: MTczMDI5NzMxOTM1Mw==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-konfety-spreads-evil-twin-apps-for-multiple-fraud-schemes Message: Refused to apply style from 'https://www.humansecurity.com/learn/blog/undefined' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

001-vjx-104.mktoresp.com
acsbapp.com
analytics.google.com
api.company-target.com
app.hubspot.com
bat.bing.com
cdn.acsbapp.com
cdn.cookielaw.org
cdn2.hubspot.net
cdnjs.cloudflare.com
client.px-cloud.net
collector-pxf69i9fy8.px-cloud.net
collector-pxxdhgmtcm.px-cloud.net
connect.facebook.net
content.hotjar.io
d2i34c80a0ftze.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
id.rlcdn.com
js.hs-analytics.net
js.hs-banner.com
js.hsleadflows.net
js.zi-scripts.com
munchkin.marketo.net
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.cdnsynd.com
s.company-target.com
script.hotjar.com
segments.company-target.com
snap.licdn.com
st.fullcircleinsights.com
static.hotjar.com
static.hsappstatic.net
stats.g.doubleclick.net
stk.px-cloud.net
tag-logger.demandbase.com
tag.demandbase.com
tags.srv.stackadapt.com
td.doubleclick.net
track.hubspot.com
tracking.g2crowd.com
ws-assets.zoominfo.com
ws.zoominfo.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.humansecurity.com
cdn.acsbapp.com
st.fullcircleinsights.com
www.humansecurity.com
104.16.117.43
104.16.118.43
104.17.24.14
104.18.37.212
104.18.89.62
108.138.106.101
13.107.42.14
13.226.34.79
13.226.94.10
142.250.65.162
142.250.80.78
142.251.32.99
142.251.40.132
142.251.40.163
142.251.41.8
151.101.44.157
18.164.96.18
18.164.96.87
192.28.147.68
199.60.103.29
23.204.6.193
2600:141b:1c00:30::1739:5a6c
2600:141b:1c00:6::17df:d145
2600:141b:1c00:6::17df:d14d
2600:9000:2511:1a00:1d:8d6d:3b40:93a1
2600:9000:28b2:7000:9:14eb:6280:93a1
2606:4700:10::ac43:b9b
2606:4700:4400::6812:2089
2606:4700:4400::ac40:9310
2606:4700::6810:7574
2606:4700::6811:ac5b
2606:4700::6811:afc9
2606:4700::6812:1eb0
2606:4700::6812:562a
2606:4700::6812:8d11
2607:f8b0:4004:c09::9b
2607:f8b0:4004:c1b::5f
2607:f8b0:4006:80a::200e
2607:f8b0:4006:80d::200e
2607:f8b0:4006:820::2002
2607:f8b0:4006:824::2008
2620:1ec:21::14
2620:1ec:33:2::10
31.13.80.12
34.107.199.61
34.96.71.22
35.190.10.96
35.244.154.8
52.85.61.60
54.146.148.156
54.91.78.159
63.33.121.64
01eb069a34fa7d0f7d4571700b2d32cc130349e970e0ec21e7a428c2fad465ab
02a711f90cf3fe3f3c91c838aa383dd9bc60d67b59e678328975e2193c1ce1d1
067536b3f91d4c08a72a02644605c37436afe7b1e60e0e251f298d5ccb082e49
0c9ad84889a30b3f1c51e3d4973466afab9f95eeb1c5791ab7e2d3a29ac4916e
0ccf743ea23f8bfed4a265908dd3a82e7710d144b93a4a52ef189a98f1e97c86
0d3b1eb7d0f0f9f6b02dc4d100a34d5ed61b9b22e284ef8b8fc16dee56cb0453
1274bb52feff24e5d53e0419178460c359db9d517b0a70513897080cac3bb920
12b5425ac2374ea6adfc1782e8f5917982421a5df79f64da407225728ab36eb8
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
17d527904615bb8d02f2fb91dd08227f626f5ba0aab65d6a820f2eb60fb2c673
1892bc981117777e575dc1231631c473cc8b57fd0d023c5e883978d5256a85ae
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
201b591d8778f953b5cde276d197d939dbc151d21e948d0e91d8869901f9eeb8
27d001801da9af0f66dfdc4b42a2a22ef3c91682ec36157d1e38c9c75e16bef6
2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254
2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4
2fc92a4b6bcd0e8fdd8b4939e421646379410fc25266f0fb5f1abf07a843f93e
31bffb649cd812a3e720b1838c910fe359aef60c46ec91149d895dc23708768d
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3e96e51bce41e61ed84d7d3bd61411f019a3098dfeaf2230a5a948ee2431471e
3fc25f32376add5872f8820fe0ac2ad8e3f7f11d798a7547ea5b813a45f1e717
42c7e51d284cd7256caf3bfebf641141876657ea0d6e5588ac7e69dce1e9cf7e
439042e0204db71db38bb4cbe130c3e520d35a14c2d9f65200308eaf1886eb64
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46043be637afe914e3a575c2921cd2904b2c4b59388128ed10625628402d46a6
461fa495106ada93686b3be60ebce7be7199d7cc646970cbb3643982bf42e989
4745aa4dd0933ecc7b66330588a90d216dd3207ca5e8720c0f10a61c00ebd6ed
4bc908c52457230d76ec146815431d06f3300b3854f4da6b2a11b210dad84fd5
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc
54922aed651f983596d7c4d47b075f10dfa004fffe6c60c15c59ecdc1856529f
54a00c1f0eaaeb0537a8297cda238d8d96c0441a708ebaba46e4f473ac94e689
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f
5b4134fc9963276fb840bb8178d62e95d0efa733909f6eeef3f364d4d60f0777
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5fcb888878533ed353b205745289b5de86181e47a1184c0ae32406d39ff06af0
629dea3fc8ca3364508e787cddbe7e6a1e0e72071d9ba2ba4539a2c60c8f1dea
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
660b03bf4238e7c9c02a55d0ccfbb6ad3362ecba8c247670b43a6fb5a7b85d82
66707b7434e14fc523f2fc692e4a190958a02598dd3d9c45ec0f65f90091727b
671367c3c0e84517f31e61945cd9ba416f89eb653dbc3c4d1828518ef5c627e7
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e36481c240a1940e57031e63729135b8c824f4b522c12d1effc0daf01d54e09
6f684971a6600c115bd3d3102c43a0b09ad5a1a3c45a818269445ba888ce8d58
7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d
78142c1a0831423d3fee5308b442b24659445ac8d7c34b92bde6624cc012f4e8
78e9659e7f8934d4952c29ce9974c0544d99243314eb56115c632a7ebc3a8b68
7bfe0695ae8a623e3bfb51affa85f41a5593014633878b4489b449d3a37a444b
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7c77cc0202a4ac0596bbca2826213c389483ee22bf66f3147ffecc085d879782
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
81f2e0a9e0cbb9cfcb5d72f56f4eff056370ddd14104251fc7066a8f7d641828
82b3a7174ae98da683cb04e50ed86410669835cd0b557f492e5095987e1264bf
8320299532b4b81498d5b3714d49c9d5938883b55f4c2a1efe6f105bf4a942bd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
88e7b0718f584603ca29ed368567c07f629f1012e0e4972c3fd95db2e339504d
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
916fce4bfe6915036ce461600bb31fd4b3c7f9970141b92f27caa76f3daace6a
92cde36d24b66c5bb39231c290e47319cc207455557a1c4ddf0b1c584422db77
92fa42c3c5bfc1e32f2979bd396d1002de3f8fdd454a487839c83025a20511d6
9c013d90ee202f7f0c56e4d0cacea4332b8437b6be5c25e5a449ca5ac6b0752e
9cac5e10bd3d5631c178a838d415c28b126daca61e10e81e6dc36aa18919174f
a123eebd3f1e4f9b4641216ddc8aee3dd0ecc035cc9d2f6ed7b92c979fccc326
a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d
a7ff04bcc70255b276f622fcc806efcaef74eb58c21f40873e769ba3b2c97467
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
adfc35d72ea1d0feaa677acecd2dafad7fdda56b02a76d7f51ad1bc067c2d499
afff892691aaab5f3a2c411cb09a2674006120f314eb8ac1fc6efb8c66a1c353
b0392294081a8113d3c077796594484f5354ebb23b518d3337738015bddb70aa
b17ad6eab5f71934277721a0558d12da27ef1c1d7688d3dc8e8440165902526b
b232e9ea2760df045a59fd0db5eb70254c81b5820c4bb19f009102bcdf12d61a
b84398de46283985db9507da817ab6fd1c66687b7b9f6d1bf3e0de29bc2b3e28
b9bb4adeb25516fad94095a077d936a5f9ad05b52050b5b4f972ee96ddba6b3b
bc134f4dbeede81af4991e9d11a713f7d0620e5d2e80311d1dbb0e51cf8cbbc6
be99b037586f1d31100f6205fb7650348bc715c0091a5495c3cb8ad8a3145ef4
c0b4eae57d5396c2444edf46c13b320be42336dae7d056dfefb771d5fc13680c
c0d57eff0936a57e0c8d6bc93314585c734e5ade88d6de970e1e305ae5d87224
cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522
cd27193574494c7c28903f1088f7eba26bf7c29f814e711e006036e733ceef8d
cd762e49a4607a3c0fdaa62f8becc923fbff15e1c0053fe12783b9ea8a6c9afe
ce435a6c403aef521ab0e71fbcd1da1122dcc577eaddf06a848bca92c7126ddf
d15f7c19eab921bdd46cf2f29ed0063cd830bca3997c7ee5a241429fe72f6b0d
d40978953ca7c452dea9ccf74628215b6918fd446e52ef0c15b34dda309c34bb
d44882ab82adeef2856a0d52fb54bb70e472be45d50aa3a16b4cb39223391a99
d4a42e8f77ed647b32311ffc6b611bdc77b6296726e51cfc958ac736c63a6654
d4e466950479eeb209f16bff7e818a991f22368eebcd3559cc45bed67b2fd92d
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
d5ea4cc18382ea8b4bab715faf7d7e79780f7b49e4b5b4e24bed6161d58cd9b6
d651066ec06c641549632f4776b2cdbf638ca0786adf1c58f44a2728daed9b00
da6268d3e4ffd8edd34230feca29fa5a83e1562bd9cf623c05737ec3eea36871
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd5e60442181c68a2711c4a407db551e51e0af167f16b86775ceb7e56679a045
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0d54140c9e5b41f4f5f8fd5583a8ae657452e2bec968966ab70c26d5ae77719
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
ee98439c11ee9f2eaece7971d414049ec4089f484c21bef2c3145533592098ba
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efa303262b36a12c1c28503edc4d8852388482855d729b169c9bfb1b969adf45
f03338548b90c8048f4814e02bf4f9ab5daedf23ce3cb50db0d345d6b2a8f6a6
fa4a4bb792839588fa1d1ebee266717634f14110146dc26d77b3e698eb1e39d3
fce461e0fefe1d6d687b3eab8304d3affaf23fb674b18bfb5242ccfc544e1bb7
fe80b695a7ab94520475cee36f00b4439a2c76d6594c14797f5971d2b1036500
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff1c989f85ae2a4c46b9ddf099129a3858ac5c476d5e0ecaaa0d68605cddd871

www.humansecurity.com Open in urlscan Pro 199.60.103.29 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

138 Requests

94 %HTTPS

42 %IPv6

38 Domains

53 Subdomains

52 IPs

4 Countries

2201 kBTransfer

6350 kBSize

55 Cookies

17 Outgoing links

Redirected requests

138 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.humansecurity.com Open in urlscan Pro
199.60.103.29 Public Scan

Screenshot
Live screenshot

Full Image

138
Requests

94 %
HTTPS

42 %
IPv6

38
Domains

53
Subdomains

52
IPs

4
Countries

2201 kB
Transfer

6350 kB
Size

55
Cookies

138 HTTP transactions
3 data transactions