URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Submission: On March 08 via api from DE — Scanned from DE

Summary

This website contacted 38 IPs in 6 countries across 28 domains to perform 126 HTTP transactions. The main IP is 2606:4700::6812:1c4a, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com. The Cisco Umbrella rank of the primary domain is 68062.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 7th 2023. Valid for: a year.
This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
21 2606:4700::68... 13335 (CLOUDFLAR...)
8 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
7 104.17.74.206 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
14 184.24.7.242 16625 (AKAMAI-AS)
2 6 2600:9000:212... 16509 (AMAZON-02)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 152.195.15.58 15133 (EDGECAST)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 44.209.137.118 14618 (AMAZON-AES)
1 2600:9000:212... 16509 (AMAZON-02)
1 35.244.142.80 15169 (GOOGLE)
1 3.214.188.44 14618 (AMAZON-AES)
2 104.87.143.22 16625 (AKAMAI-AS)
5 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2001:4860:480... 15169 (GOOGLE)
2 2600:9000:212... 16509 (AMAZON-02)
1 3 2620:1ec:21::14 8068 (MICROSOFT...)
12 65.9.95.10 16509 (AMAZON-02)
1 37.252.171.53 29990 (ASN-APPNEX)
1 2a02:26f0:11a... 20940 (AKAMAI-ASN1)
2 34.111.208.231 396982 (GOOGLE-CL...)
2 2001:4860:480... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 2a05:d018:cc3... 16509 (AMAZON-02)
1 192.28.144.124 15224 (OMNITURE)
1 34.214.245.73 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 52.37.218.4 16509 (AMAZON-02)
1 35.81.162.201 16509 (AMAZON-02)
126 38
Apex Domain
Subdomains
Transfer
28 zscaler.com
www.zscaler.com — Cisco Umbrella Rank: 68062
info.zscaler.com — Cisco Umbrella Rank: 357511
887 KB
15 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6183
c.6sc.co — Cisco Umbrella Rank: 9154
ipv6.6sc.co — Cisco Umbrella Rank: 6582
b.6sc.co — Cisco Umbrella Rank: 4625
17 KB
12 fullcircleinsights.com
st.fullcircleinsights.com — Cisco Umbrella Rank: 76931
12 KB
8 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 363
131 KB
7 google.com
www.google.com — Cisco Umbrella Rank: 2
region1.analytics.google.com — Cisco Umbrella Rank: 4223
1 KB
7 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2423
d.adroll.com — Cisco Umbrella Rank: 1220
23 KB
6 google.de
www.google.de — Cisco Umbrella Rank: 6027
904 B
6 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 28
stats.g.doubleclick.net — Cisco Umbrella Rank: 73
5 KB
4 mountain.com
dx.mountain.com — Cisco Umbrella Rank: 6955
px.mountain.com — Cisco Umbrella Rank: 7092
gs.mountain.com — Cisco Umbrella Rank: 12349
9 KB
3 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 317
www.linkedin.com — Cisco Umbrella Rank: 556
1 KB
3 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 809
gw.linkedin.oribi.io — Cisco Umbrella Rank: 13082
24 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 15022
ibc-flow.techtarget.com — Cisco Umbrella Rank: 19253
2 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 24
20 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 41
269 KB
2 googleusercontent.com
lh4.googleusercontent.com — Cisco Umbrella Rank: 371
66 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 108
257 B
2 cloudfunctions.net
us-central1-adaptive-growth.cloudfunctions.net — Cisco Umbrella Rank: 2485
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 2859
6 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 145
137 KB
2 bing.com
bat.bing.com — Cisco Umbrella Rank: 343
12 KB
1 mktoresp.com
306-zej-256.mktoresp.com — Cisco Umbrella Rank: 717339
318 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 380
812 B
1 sf14g.com
t.sf14g.com — Cisco Umbrella Rank: 56639
1 pdst.fm
cdn.pdst.fm — Cisco Umbrella Rank: 2439
6 KB
1 cloudfront.net
d2i34c80a0ftze.cloudfront.net
11 KB
1 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 7385
32 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 686
5 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 586
304 B
126 28
Domain Requested by
21 www.zscaler.com www.zscaler.com
12 b.6sc.co
12 st.fullcircleinsights.com cdn.bizible.com
8 cdn.cookielaw.org www.zscaler.com
cdn.cookielaw.org
7 info.zscaler.com www.zscaler.com
info.zscaler.com
6 www.google.de
6 s.adroll.com 2 redirects www.googletagmanager.com
s.adroll.com
5 www.google.com
3 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 googleads.g.doubleclick.net www.googletagmanager.com
3 www.googletagmanager.com www.zscaler.com
www.googletagmanager.com
2 px.mountain.com dx.mountain.com
www.zscaler.com
2 lh4.googleusercontent.com www.zscaler.com
2 www.facebook.com
2 us-central1-adaptive-growth.cloudfunctions.net cdn.pdst.fm
2 ibc-flow.techtarget.com cdn.bizible.com
2 px.ads.linkedin.com 1 redirects
2 cdn.linkedin.oribi.io snap.licdn.com
2 region1.analytics.google.com www.googletagmanager.com
2 munchkin.marketo.net www.zscaler.com
munchkin.marketo.net
2 connect.facebook.net www.zscaler.com
connect.facebook.net
2 bat.bing.com www.googletagmanager.com
bat.bing.com
1 gs.mountain.com www.zscaler.com
1 gw.linkedin.oribi.io cdn.bizible.com
1 306-zej-256.mktoresp.com munchkin.marketo.net
1 d.adroll.com s.adroll.com
1 ipv6.6sc.co cdn.bizible.com
1 c.6sc.co cdn.bizible.com
1 secure.adnxs.com cdn.bizible.com
1 www.linkedin.com
1 t.sf14g.com www.zscaler.com
1 cdn.pdst.fm www.zscaler.com
1 d2i34c80a0ftze.cloudfront.net www.googletagmanager.com
1 dx.mountain.com www.zscaler.com
1 trk.techtarget.com www.zscaler.com
1 cdn.bizible.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 j.6sc.co www.zscaler.com
1 geolocation.onetrust.com cdn.cookielaw.org
126 40
Subject Issuer Validity Valid
www.zscaler.com
DigiCert SHA2 Extended Validation Server CA
2023-02-07 -
2024-03-09
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2022-05-01 -
2023-05-01
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
info.zscaler.com
Cloudflare Inc ECC CA-3
2022-11-08 -
2023-11-07
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
s.adroll.com
Amazon RSA 2048 M02
2023-02-24 -
2023-08-01
5 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2023-02-16 -
2023-08-16
6 months crt.sh
io.bizible.com
DigiCert TLS RSA SHA256 2020 CA1
2022-06-30 -
2023-07-31
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-01-10 -
2023-03-16
2 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-07-25 -
2023-07-25
a year crt.sh
*.mountain.com
Go Daddy Secure Certificate Authority - G2
2022-05-21 -
2023-06-22
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
cdn.pdst.fm
GTS CA 1D4
2023-01-28 -
2023-04-28
3 months crt.sh
t.sf14g.com
Go Daddy Secure Certificate Authority - G2
2022-07-11 -
2023-08-12
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
www.google.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh
www.google.de
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-02-24 -
2023-08-06
5 months crt.sh
aws-st.fullcircleinsights.com
Amazon RSA 2048 M02
2023-02-21 -
2023-07-11
5 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
ibc-flow.techtarget.com
GTS CA 1D4
2023-02-05 -
2023-05-06
3 months crt.sh
*.google.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh
*.google.de
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh
misc.google.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh
d.adroll.com
Amazon RSA 2048 M01
2022-11-08 -
2023-12-07
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2023-03-07 -
2023-09-07
6 months crt.sh
*.googleusercontent.com
GTS CA 1C3
2023-02-20 -
2023-05-15
3 months crt.sh

This page contains 3 frames:

Primary Page: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Frame ID: 058D1357CF7A4793CD795B479E9184BD
Requests: 116 HTTP requests in this frame

Frame: https://info.zscaler.com/index.php/form/XDFrame
Frame ID: 4EDFAEE095C8E3A224046BD2525E74AB
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: FF75D7A6EB14C199E4D7D02C6C993A43
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

OneNote: A Growing Threat for Malware Distribution

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Page Statistics

126
Requests

97 %
HTTPS

62 %
IPv6

28
Domains

40
Subdomains

38
IPs

6
Countries

1676 kB
Transfer

4879 kB
Size

36
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 68
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678306604743&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1678306604743%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fonenote-growing-threat-malware-distribution%26liSync%3Dtrue
Request Chain 72
  • https://s.adroll.com/j/exp/ULSJHTPGTZGY3EPPZSKHKS/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 73
  • https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js

126 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request onenote-growing-threat-malware-distribution
www.zscaler.com/blogs/security-research/
206 KB
43 KB
Document
General
Full URL
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfd8136322c3df6d16bc5e48910712cb01c53d7f63d40cb0537c00389cb1aec4
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com; img-src 'self' https: data: blob:; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM testmydefenses.com
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
55
cache-control
max-age=31536000, public
cf-cache-status
DYNAMIC
cf-ray
7a4dc1e9c8189134-FRA
content-encoding
br
content-language
en
content-security-policy
default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com; img-src 'self' https: data: blob:; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251
content-type
text/html; charset=UTF-8
date
Wed, 08 Mar 2023 20:16:43 GMT
expires
Sun, 19 Nov 1978 05:00:00 GMT
last-modified
Wed, 08 Mar 2023 20:15:46 GMT
permissions-policy
interest-cohort=()
server
cloudflare
strict-transport-security
max-age=31536000; preload
vary
X-UA-Device,Accept-Encoding
via
varnish
x-ah-environment
prod
x-cache
HIT
x-cache-hits
4
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM testmydefenses.com
x-request-id
v-02fd64e6-bdee-11ed-af8d-ffc63426dae1
x-ua-compatible
IE=edge
x-xss-protection
1
OtAutoBlock.js
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/
45 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/OtAutoBlock.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef401955627aaaedffd337dc3a7c4f9ad56f5dcd31f13833772760cda1aaa437
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
1BoBNuQl7UMMaO7E490CGQ==
age
24746
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6406
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:15 GMT
server
cloudflare
etag
0x8DAE80BD5AAEF51
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
2303b106-501e-014a-7ef4-19aed4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dc1ef7d28903d-FRA
expires
Thu, 09 Mar 2023 20:16:43 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
25 KB
9 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da9a77e15c8cbf2596563d3bc8020cc9e547d2b99976a0b77f5eeadf1c492feb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Ewgd1d1Vp0nFNYpIMiFTtA==
age
75336
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
8460
x-ms-lease-status
unlocked
last-modified
Tue, 07 Mar 2023 03:55:46 GMT
server
cloudflare
etag
0x8DB1EBFD503AE0E
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
61d76cec-301e-0115-3a13-515c2a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dc1ef7d2c903d-FRA
google_tag.script.js
www.zscaler.com/sites/default/files/google_tag/zscaler_marketing_production/
347 B
381 B
Script
General
Full URL
https://www.zscaler.com/sites/default/files/google_tag/zscaler_marketing_production/google_tag.script.js?rr7pgi
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99b5a6256a9ee7c2640c2669ed517975bfb713b36dc3dde5c55b3c2c85885f4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
9659
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-6b59afc2-bdd5-11ed-b239-f7a1b58e7c57
last-modified
Wed, 08 Mar 2023 17:19:40 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
cf-ray
7a4dc1efb9dd9134-FRA
expires
Thu, 07 Mar 2024 17:19:44 GMT
css_NZsRhReLmcJsHvswoam3Xgy1qgq89jev--YsTfoMoZ8.css
www.zscaler.com/sites/default/files/css/
378 KB
33 KB
Stylesheet
General
Full URL
https://www.zscaler.com/sites/default/files/css/css_NZsRhReLmcJsHvswoam3Xgy1qgq89jev--YsTfoMoZ8.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
359b1185178b99c26c1efb30a1a9b75e0cb5aa0abcf637affbe62c4dfa0ca19f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
133297
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-8c3ea8f0-bc63-11ed-a715-9f3a17ce1678
last-modified
Mon, 06 Mar 2023 21:11:22 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
cf-ray
7a4dc1ef392b9134-FRA
expires
Tue, 05 Mar 2024 21:12:05 GMT
css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
www.zscaler.com/sites/default/files/css/
462 KB
73 KB
Stylesheet
General
Full URL
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2aaa0eac6ba23ee39304a3badfb67a930293225d20cd99538e0064186ca3ee91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
215805
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-97c9546c-bbdd-11ed-8bd4-c359ecf63a7a
last-modified
Mon, 06 Mar 2023 05:13:04 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
cf-ray
7a4dc1ef392d9134-FRA
expires
Tue, 05 Mar 2024 05:13:12 GMT
logo.svg
www.zscaler.com/themes/custom/zscaler/
2 KB
1 KB
Image
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/logo.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb71a91ef4937bdac04520d7e7b1852bb28635ae850934d440360ccc8142c1a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
2
date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3142954
content-encoding
br
x-cache
HIT
x-ah-environment
prod
x-request-id
v-389ba100-a131-11ed-bfd3-73acc08f499c
last-modified
Thu, 22 Sep 2022 07:27:05 GMT
server
cloudflare
vary
Host, Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=31536000
cf-ray
7a4dc1efb9e09134-FRA
expires
Thu, 07 Mar 2024 20:16:43 GMT
3e894970-e3e9-4783-85e9-7c38eedbfbbf.json
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/3e894970-e3e9-4783-85e9-7c38eedbfbbf.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7cfd5dc386d092ab9afb5af683856ed88121e55e6bf1024333c3151ccc46e36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
StpE19/mctRp4PJx19Cb7Q==
age
61542
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1739
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:16 GMT
server
cloudflare
etag
0x8DAE80BD639ADC0
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
519b3767-a01e-0036-72f4-1975b4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dc1efee963a61-FRA
expires
Thu, 09 Mar 2023 20:16:43 GMT
gt-haptik-zs-regular-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
18 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-regular-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f7832c8054c16e592d3697f5612969b692ac94197aa591b5487795f7c928c1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3142954
x-cache
MISS
x-ah-environment
prod
content-length
18848
x-request-id
v-e8e4ca98-a157-11ed-a676-9fd5b0daa878
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1effa509134-FRA
expires
Thu, 07 Mar 2024 20:16:43 GMT
fa-solid-900.woff2
www.zscaler.com/themes/custom/zscaler/build/webfonts/
134 KB
135 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/build/webfonts/fa-solid-900.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d23676da3d5b10007f7f675da723f274604cd88397dc25c4721519973994a71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
5
date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3142954
x-cache
HIT
x-ah-environment
prod
content-length
137704
x-request-id
v-4907e8f8-a0ac-11ed-b332-675e65b356ce
last-modified
Thu, 22 Sep 2022 07:26:42 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1effa529134-FRA
expires
Thu, 07 Mar 2024 20:16:43 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
304 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9062 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7a4dc1f0dedb92c3-FRA
access-control-allow-headers
Content-Type
email-decode.min.js
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
824 B
Script
General
Full URL
https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
last-modified
Fri, 03 Mar 2023 16:16:37 GMT
server
cloudflare
content-encoding
gzip
etag
W/"64021d65-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
7a4dc1f09b6c9134-FRA
expires
Fri, 10 Mar 2023 20:16:43 GMT
js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
www.zscaler.com/sites/default/files/js/
345 KB
113 KB
Script
General
Full URL
https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab064f552d9f6c01de22431e5ffa4dec46c5fea8c2ecda8d5cd3b8573863308b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
215806
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-97d4cb44-bbdd-11ed-83e5-6380eb2be68b
last-modified
Mon, 06 Mar 2023 05:13:04 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000
cf-ray
7a4dc1f09b6e9134-FRA
expires
Tue, 05 Mar 2024 05:13:12 GMT
forms2.min.js
info.zscaler.com/js/forms2/js/
208 KB
69 KB
Script
General
Full URL
https://info.zscaler.com/js/forms2/js/forms2.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
2950
etag
"340d43-33e51-5f217594de500"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7a4dc1f2ef379049-FRA
expires
Thu, 09 Mar 2023 00:16:43 GMT
js_bs8YJ93pC4zs7puF5kViK1HmmxKyuhrk1IT8C57y-EI.js
www.zscaler.com/sites/default/files/js/
149 KB
41 KB
Script
General
Full URL
https://www.zscaler.com/sites/default/files/js/js_bs8YJ93pC4zs7puF5kViK1HmmxKyuhrk1IT8C57y-EI.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ecf1827dde90b8cecee9b85e645622b51e69b12b2ba1ae4d484fc0b9ef2f842
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3065100
content-encoding
br
x-cache
MISS
x-ah-environment
prod
x-request-id
v-442371a0-a1ff-11ed-9c9b-979a585b96ff
last-modified
Wed, 01 Feb 2023 07:08:05 GMT
server
cloudflare
vary
Host,Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000
cf-ray
7a4dc1f09b709134-FRA
expires
Thu, 01 Feb 2024 07:08:45 GMT
blog-subscription-form-background%401x.jpeg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/page/blog/
8 KB
8 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/page/blog/blog-subscription-form-background%401x.jpeg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe40bb752bab0a83fce103714fcd294ebc51314978fd77c81fe1842d1452df80
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
8021
cf-resized
internal=ok/h q=0 n=19+0 c=2+403 v=2023.1.3 l=8021
last-modified
Fri, 09 Dec 2022 08:42:57 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cftz37uaFigiYaqZiowwIKFZQi1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f09b719134-FRA
gt-haptik-zs-bold-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
19 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-bold-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a83018a0ad67600ad05abd4fb02932d92e620f065ea461628d51607b644bd363
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
1
date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3142954
x-cache
HIT
x-ah-environment
prod
content-length
19652
x-request-id
v-e8352a70-a157-11ed-96e2-c3a34c6dfaba
last-modified
Thu, 22 Sep 2022 07:26:42 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f09b729134-FRA
expires
Thu, 07 Mar 2024 20:16:43 GMT
fa-brands-400.woff2
www.zscaler.com/themes/custom/zscaler/build/webfonts/
74 KB
74 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/build/webfonts/fa-brands-400.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79e40ce5098ca3d5d3ed476b2b4e156829bdec21fb8c07bab967f6525f5c5677
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
1
date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
1870362
x-cache
HIT
x-ah-environment
prod
content-length
76008
x-request-id
v-e87886a8-a157-11ed-8619-f73854114736
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f09b749134-FRA
expires
Thu, 07 Mar 2024 20:16:43 GMT
home-footer-background@2x.jpg
www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/footer/
83 KB
83 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/footer/home-footer-background@2x.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49ae74412b388787f2247d5ce9809c636a7e8768025dd67013fc0c9188526b52
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
84873
cf-resized
internal=ok/h q=0 n=25+0 c=19+387 v=2023.2.6 l=84873
last-modified
Thu, 22 Sep 2022 07:26:42 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
"cf5D8tnnwqJBq6DOrnwhmSLWE71gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
warning
cf-images 299 "image too large for AVIF", cf-images 299 "original is 10213B smaller"
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f11c389134-FRA
gt-haptik-zs-medium-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
19 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-medium-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0026207a95ec76029445ec7fd6eda7a06dfb1778cb84464e36f661711db17ea4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_KqoOrGuiPuOTBKO637Z6kwKTIl0gzZlTjgBkGGyj7pE.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-cache-hits
1
date
Wed, 08 Mar 2023 20:16:43 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3142953
x-cache
HIT
x-ah-environment
prod
content-length
19504
x-request-id
v-e83517e2-a157-11ed-b50c-4b8c5d713c3a
last-modified
Thu, 22 Sep 2022 07:26:19 GMT
server
cloudflare
vary
Host, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f11c379134-FRA
expires
Thu, 07 Mar 2024 20:16:43 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.39.0/
372 KB
89 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Zp/CcrZmK7hQ2S6c/t9Tpw==
age
76128
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
90454
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:31:04 GMT
server
cloudflare
etag
0x8DA87805EB35DE2
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
4d551430-601e-0064-4137-ea6846000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dc1f13f37903d-FRA
fail-over.js
www.zscaler.com/
0
195 B
XHR
General
Full URL
https://www.zscaler.com/fail-over.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3142955
x-cache
MISS
x-ah-environment
prod
content-length
0
x-request-id
v-e890de1a-a157-11ed-b8b2-37684c93071f
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f2eef09134-FRA
expires
Thu, 07 Mar 2024 20:16:44 GMT
fail-over.js
www.zscaler.com/
0
45 B
Script
General
Full URL
https://www.zscaler.com/fail-over.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
via
varnish
age
3142955
x-cache
MISS
x-ah-environment
prod
content-length
0
x-request-id
v-e890de1a-a157-11ed-b8b2-37684c93071f
last-modified
Thu, 22 Sep 2022 07:27:04 GMT
server
cloudflare
vary
Host, Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f33f5f9134-FRA
expires
Thu, 07 Mar 2024 20:16:44 GMT
phishing-spam-2%402x.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blogs/----category-images/phishing-spam/
37 KB
38 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blogs/----category-images/phishing-spam/phishing-spam-2%402x.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d1f4dc8f57f1369b2c6e76000c2aa140c684b60459c7f09f4baa7103d14b8a8
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
38371
cf-resized
internal=ok/h q=0 n=12+228 c=0+0 v=2023.2.4 l=38371
last-modified
Fri, 04 Sep 2020 11:16:11 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cfX0La5_rO0woqb2I4kGLlGM7p1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f38fd89134-FRA
gtm.js
www.googletagmanager.com/
411 KB
111 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/google_tag/zscaler_marketing_production/google_tag.script.js?rr7pgi
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
841d0c87a0e119520d9786d40e294123ec78a72b4c1c3578882f9dfd81c95539
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
113660
x-xss-protection
0
last-modified
Wed, 08 Mar 2023 19:08:21 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 08 Mar 2023 20:16:44 GMT
getForm
info.zscaler.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=1944&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&callback=jQuery112405821815341940071_1678306604079&_=1678306604080
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c2b18b909fd895ea5ca754507cb84b94d0a35ec1e1520bd67a5446906268564

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7a4dc1f3e89b9049-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
getForm
info.zscaler.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=7140&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&callback=jQuery112405821815341940071_1678306604081&_=1678306604082
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3d28c70f877331d163f4ce3465faea62cbd7658e40337a90ccbe8b1f3da16ff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7a4dc1f3e89d9049-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
zscaler-company-blogs-seconday-hero-secure-the-workforce%402x.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/blog-hero/
22 KB
22 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/blog-hero/zscaler-company-blogs-seconday-hero-secure-the-workforce%402x.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
979fad71a30e04878ea6f208924e89593d93fac949e1ddcdd824e265d840b32e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
22456
cf-resized
internal=ok/h q=0 n=24+0 c=6+141 v=2023.2.1 l=22456
last-modified
Fri, 06 Nov 2020 06:04:35 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfr924Qcc40f4MnRBiOK27oTqo1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
warning
cf-images 299 "image too large for AVIF"
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1f3f85c9134-FRA
en.json
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/57d0b2fd-5e95-4e1b-923d-cff7f0c71c9e/
76 KB
15 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/57d0b2fd-5e95-4e1b-923d-cff7f0c71c9e/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
69fe3a3cb8e52c9522e1317a41bfda30f19e6c199fb84c66f083cd9e35e46442
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
a+O//X2h08gSfqxZ78vXYQ==
age
33944
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
15164
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:17 GMT
server
cloudflare
etag
0x8DAE80BD6BFBADE
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
89be1b07-701e-00f3-1cf4-190b8f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dc1f3fe3b3a61-FRA
expires
Thu, 09 Mar 2023 20:16:44 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Xx897lTVYGjMQiwuGCrzDA==
age
24943
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
3007
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:30:55 GMT
server
cloudflare
etag
0x8DA87805972EF22
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
6e038401-f01e-012a-24f6-e1ebf6000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dc1f46f233a61-FRA
otCookieSettingsButton.json
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
5 KB
2 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCookieSettingsButton.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ssl6Phwu9+sah2W05EtyUQ==
age
33944
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1767
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:30:57 GMT
server
cloudflare
etag
0x8DA87805A8DD1F0
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
dfb40754-401e-0155-80f6-e175c4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7a4dc1f46f253a61-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
22 KB
5 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 08 Mar 2023 20:16:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
B55i3ZY9miZIaUrwjufy0w==
age
35212
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:31:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
dfb3fa52-401e-0155-4af6-e175c4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
7a4dc1f46f263a61-FRA
forms2.css
info.zscaler.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://info.zscaler.com/js/forms2/css/forms2.css
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
325
etag
"340d3b-3437-5f217594de500"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7a4dc1f4692f9049-FRA
content-length
2623
expires
Thu, 09 Mar 2023 00:16:44 GMT
forms2-theme-round.css
info.zscaler.com/js/forms2/css/
4 KB
1 KB
Stylesheet
General
Full URL
https://info.zscaler.com/js/forms2/css/forms2-theme-round.css
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
6824
etag
"340d3a-e46-5f217594de500"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7a4dc1f469309049-FRA
content-length
968
expires
Thu, 09 Mar 2023 00:16:44 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/?random=1678306604295&cv=11&fst=1678306604295&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&auid=1555387113.1678306604&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
08ac0b1c6a749cc1b5e6e71fe2be06b21a3b304e8ca577c6a5349e5609963aec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1242
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 08 Mar 2023 20:14:50 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
114
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Wed, 08 Mar 2023 22:14:50 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1678306604303&cv=11&fst=1678306604303&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&auid=1555387113.1678306604&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
cc61567118cf364a9ecf1106fc903b48222916262e036b48db3145167d5aa2d3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1240
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/
253 KB
84 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3fba09ed466b1934699b1f3f7d487d3799c3db8bc7ff5ec6bb2ff107bc86a0fb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
85624
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 08 Mar 2023 20:16:44 GMT
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
XDFrame
info.zscaler.com/index.php/form/ Frame 4EDF
2 KB
874 B
Document
General
Full URL
https://info.zscaler.com/index.php/form/XDFrame
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7a4dc1f5caac9049-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 08 Mar 2023 20:16:44 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
6si.min.js
j.6sc.co/
33 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 09 Feb 2023 18:18:39 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63e538ff-820b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
10438
expires
Wed, 08 Mar 2023 20:16:44 GMT
roundtrip.js
s.adroll.com/j/
57 KB
19 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:3000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4bceb9f32efde2d668a8d95c0a9ac403bb83e3fd48e8d4b91bda4855910963fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
CKFhTaQFx2V3ldZqcsFc4q9le912SObA
Content-Encoding
gzip
Via
1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
Date
Wed, 08 Mar 2023 19:33:42 GMT
Age
2770
X-Amz-Cf-Pop
PRG50-C1
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Thu, 23 Feb 2023 21:36:59 GMT
Server
AmazonS3
Etag
W/"8ae4154f2f795bd765a3220cec1127fe"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
h2FeRha4uWA696RKLcqE1MkfpwxBIz_6RlEGauEsn0DMbQKfuZGbdw==
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=29789
accept-ranges
bytes
content-length
4777
bat.js
bat.bing.com/
40 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Wed, 08 Mar 2023 20:16:44 GMT
last-modified
Thu, 16 Feb 2023 18:31:53 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 78302296BDB54A52AE3E2BDC6AEAA318 Ref B: FRA31EDGE0117 Ref C: 2023-03-08T20:16:44Z
etag
"8072cff03442d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
11894
bizible.js
cdn.bizible.com/scripts/
83 KB
32 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
1ae740ebbe1a0c68cdf60b2d5df40126d47e6c69d19bf794b8a99ad5ceb81992

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
last-modified
Sat, 04 Mar 2023 02:07:06 GMT
server
ECS (frb/67D4)
age
75509
etag
"548fe53e4ed91:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
32327
fbevents.js
connect.facebook.net/en_US/
107 KB
28 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0fca0294cfaf24a4db0852415eee7bcdea7b9766d59e443fb2d5f0c77eb23363
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Wed, 08 Mar 2023 20:16:44 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27907
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
PkRs0RKxVAHBEXfwwMf5QcWGTfE2fUKdZnzkyNNcrNPhnh68E6/9lGakdg+waFzxR5bflZqkVXkMFAgFzdCxUQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-trip-id
686109401
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d9f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
server
cloudflare
age
69
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=1200
cf-ray
7a4dc1f68ec29b67-FRA
expires
Wed, 08 Mar 2023 20:25:35 GMT
spx
dx.mountain.com/
15 KB
4 KB
Script
General
Full URL
https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=94496331094753460term=value
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.209.137.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-209-137-118.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
80453cb0a63879a2b1427acf4847d5c93e0aed56b8e0c5b603229efccbb1dd19

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
server
istio-envoy
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
x-envoy-upstream-service-time
1
be
spx-prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
fullcircle.js
d2i34c80a0ftze.cloudfront.net/
31 KB
11 KB
Script
General
Full URL
https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=731c316a-c46e-4a94-81a9-7cfc0ea0d53e&domain=zscaler.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:c00:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
df26e59b0ea17beea7651010590153fdbee9f22a8d12315e8e9c3cc6973fcb22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 01:21:09 GMT
via
1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront), 1.1 97101640da3dcba7a2d4a3d67a31b114.cloudfront.net (CloudFront)
content-encoding
gzip
x-amz-cf-pop
FRA6-C1, PRG50-C1
age
68135
x-amzn-requestid
adb53740-549e-4912-9e99-71e683a746c5
x-amzn-trace-id
Root=1-6407e305-7022e2cc5f56da78176ccf8c;Sampled=0
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amz-apigw-id
BcBo1G86vHcFnpw=
x-amz-cf-id
U0LuW8hv-UT4YndPCUzTUUIwzI1YzyNg6VBAJl9AijBgduupQ3thuw==
ping.min.js
cdn.pdst.fm/
26 KB
6 KB
Script
General
Full URL
https://cdn.pdst.fm/ping.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
80.142.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:14:59 GMT
content-encoding
gzip
age
105
x-guploader-uploadid
ADPycdusK7d9n7molm2B1P6sTDjxVbZqXS7dhMerr6WH6ztADLgjqhBPlDKXiGBnZYXoYwDNVlbQ01Opyw2Lfv825EiD
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5774
last-modified
Fri, 28 May 2021 20:34:03 GMT
server
UploadServer
etag
"d001d1c9f5a942fa5524eeacb047e819"
vary
Accept-Encoding
x-goog-generation
1622234043862937
x-goog-hash
crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
5774
accept-ranges
bytes
content-type
application/javascript;
expires
Wed, 08 Mar 2023 21:14:59 GMT
js
www.googletagmanager.com/gtag/
217 KB
74 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-812494211
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
345771b135821e8ea4462d4ab1ac33604e66b0769e4d3cefe885b4ecbca51ea7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
75281
x-xss-protection
0
last-modified
Wed, 08 Mar 2023 19:56:24 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 08 Mar 2023 20:16:44 GMT
sf14g.js
t.sf14g.com/
0
0
Script
General
Full URL
https://t.sf14g.com/sf14g.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.214.188.44 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-188-44.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.87.143.22 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-87-143-22.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
ef2ca5ac3d9cf4d005d7294562694e44b40efd2c194722721a52743c2f43f1a6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Wed, 08 Mar 2023 20:16:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Mar 2023 02:09:07 GMT
Server
AkamaiNetStorage
ETag
"fefdb331ffca929fc0e661337b64ed4f:1678241347.158405"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
741
/
www.google.com/pagead/1p-user-list/973777747/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/973777747/?random=1678306604295&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=1341454948&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/973777747/
42 B
455 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/973777747/?random=1678306604295&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=1341454948&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/812494211/
42 B
108 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/812494211/?random=1678306604303&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=3383023040&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/812494211/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/812494211/?random=1678306604303&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45He3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&fmt=3&is_vtc=1&random=3383023040&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
349 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-6177009-1&cid=772013321.1678306604&jid=435366142&gjid=1262823128&_gid=1346087424.1678306604&_u=YGBAiEABBAAAAEAAI~&z=1931854146
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
4 B
147 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1054683009&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&ul=en-us&de=UTF-8&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Engagement&ea=10%25&el=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&_u=YGDACEABBAAAAGAAI~&jid=479231227&gjid=604270422&cid=772013321.1678306604&tid=UA-6177009-1&_gid=1346087424.1678306604&_r=1&_slc=1&gtm=45He3360n715SLZFK&z=1806012120
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
194 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j99&a=1054683009&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&ul=en-us&de=UTF-8&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAiEABBAAAAAAAI~&jid=435366142&gjid=1262823128&cid=772013321.1678306604&tid=UA-6177009-1&_gid=1346087424.1678306604&gtm=45He3360n715SLZFK&z=1711443808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 09:08:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
40079
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
forms2.min.js
info.zscaler.com/js/forms2/js/ Frame 4EDF
208 KB
69 KB
Script
General
Full URL
https://info.zscaler.com/js/forms2/js/forms2.min.js
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://info.zscaler.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
2951
etag
"340d43-33e51-5f217594de500"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7a4dc1f70bfd9049-FRA
expires
Thu, 09 Mar 2023 00:16:44 GMT
collect
region1.analytics.google.com/g/
0
254 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je3360&_p=1054683009&_gaz=1&cid=772013321.1678306604&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1678306604&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&en=page_view&_fv=1&_ss=1&ep.allowLinker=true&ep.cookieDomain=auto
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
56 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-10SPJ4YJL9&cid=772013321.1678306604&gtm=45je3360&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-10SPJ4YJL9&cid=772013321.1678306604&gtm=45je3360&aip=1&z=788979102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
70 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-6177009-1&cid=772013321.1678306604&jid=479231227&gjid=604270422&_gid=1346087424.1678306604&_u=YGDACEABBAAAAGAAI~&z=1947476120
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=772013321.1678306604&jid=435366142&_u=YGBAiEABBAAAAEAAI~&z=310180436
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=772013321.1678306604&jid=435366142&_u=YGBAiEABBAAAAEAAI~&z=310180436
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1778897272132032
connect.facebook.net/signals/config/
381 KB
109 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1778897272132032?v=2.9.98&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b676116353f4fc61b28c4305cd66e29e6425b9718b21ea0341987db6aa0850f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 08 Mar 2023 20:16:44 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
110973
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
jDKva12DkS0B+Ub2c903oFy8O5A/13pmFA/OBS+qdkEHfFu012TAdH11OewIlPfCd9HFYVpatzlbXMvelqne5g==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-trip-id
686109401
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
token
cdn.linkedin.oribi.io/partner/33962/domain/zscaler.com/
38 B
378 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/33962/domain/zscaler.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:5600:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
9581d252706f6236028acf67e89cd0c2f8ec64ff46a416bf384b2fd3876080d4

Request headers

Accept
*
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:01:54 GMT
content-encoding
gzip
via
1.1 b031f43146c9801101822eabdc464390.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
age
891
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
gKgwJdnRTYDz51jV7hM8ZPrMZKdJ-uZL3wjFbpvs_O2crWrcZHgzAw==
li_sync
www.linkedin.com/px/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1678306604743&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1678306604743%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblog...
0
199 B
Image
General
Full URL
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1678306604743%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fonenote-growing-threat-malware-distribution%26liSync%3Dtrue
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 4CC63DEEA42245EFADCD83FF0BBD22C5 Ref B: FRAEDGE1117 Ref C: 2023-03-08T20:16:44Z
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
cache-control
no-cache, no-store
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2aTUDnVXmDvMOv2k31g==
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Wed, 08 Mar 2023 20:16:44 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 658B7DFB8749464BA69BEEF5FEFF42D6 Ref B: FRAEDGE1117 Ref C: 2023-03-08T20:16:44Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1678306604743%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fonenote-growing-threat-malware-distribution%26liSync%3Dtrue
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2aTUBb9SeKzQHYt1XgA==
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash
d9b3ce107ec44b1244cb53d0b7ed01a9abcfc84573daa0b50d078003388c1248

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
x-amzn-trace-id
Root=1-6408ed2d-123281754d4f8375271d6110;Sampled=0
x-amzn-requestid
059a62d7-6132-4efe-9e61-0acb9bb16fdd
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Ben_JF1zPHcF1dQ=
content-length
1406
x-amz-cf-id
jpQDPC-wczacUE_Hnep1K_YWHrarWMUNRKtPw1Q0HXaNHLs93lhxIA==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:16:45 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-apigw-id
Ben_HE-VPHcFlbQ=
x-amz-cf-id
LnUPeuUpGSy6QswUDri7b_rkczMxmApOU58Z82tHbRk7PyAqJuGgGw==
x-amz-cf-pop
PRG50-C1
x-amzn-requestid
cecb7859-4711-49c4-96a0-5e85cf8ca98f
x-cache
Miss from cloudfront
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1678306604826&cv=11&fst=1678306604826&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&auid=1555387113.1678306604&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c589a912b24ef0609b0f6fe12718d82a82a600a5d9ce212f658e51d642cedff7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1261
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/ULSJHTPGTZGY3EPPZSKHKS/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
785 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Server
2600:9000:2127:3000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
CiD7z5Qr2ECIL.Zbw84rFXTGVfvZ9kAA
Date
Wed, 08 Mar 2023 01:47:42 GMT
Via
1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
Age
66549
X-Amz-Cf-Pop
PRG50-C1
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Thu, 01 Dec 2022 00:29:34 GMT
Server
AmazonS3
Etag
"5816cced8568d223aa09d889f300692b"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
Pl19f8L_krb_7kAQga6QT_bitVUrcnIr1Hz27iUSRwDPJwvkUHMnNA==

Redirect headers

Date
Wed, 08 Mar 2023 06:52:37 GMT
Via
1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
Age
48247
X-Amz-Cf-Pop
PRG50-C1
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
pRpUAocovxILUJjW2CrvjrLL04zpwhFpSFx_7apKhy_USyVv7kYvkg==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
756 B
Script
General
Full URL
https://s.adroll.com/j/pre/index.js
Protocol
HTTP/1.1
Server
2600:9000:2127:3000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Date
Wed, 08 Mar 2023 01:27:51 GMT
Via
1.1 cb11ca2ff3db5adbe7df4bca70e51594.cloudfront.net (CloudFront)
Age
70660
X-Amz-Cf-Pop
PRG50-C1
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
BJWIWxULESrTwzaO9f_ak_oZEAe6zU0CgYHO3vlvoGhmP3Llg9BVdQ==

Redirect headers

Date
Wed, 08 Mar 2023 06:58:58 GMT
Via
1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
Age
47865
X-Amz-Cf-Pop
PRG50-C1
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
gHyD6v4HDF3KI-9x4t2RW0oBaNzc9-DI0Q1wrezAJhyFXqNCvA1kYw==
index.js
s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/
0
808 B
Script
General
Full URL
https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:3000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-Amz-Version-Id
hJkD9OBQgUxq8wryMQzTIgzdUJcjExH3
Date
Wed, 08 Mar 2023 20:11:54 GMT
Via
1.1 cb11ca2ff3db5adbe7df4bca70e51594.cloudfront.net (CloudFront)
Age
291
X-Amz-Cf-Pop
PRG50-C1
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Sat, 04 Mar 2023 22:02:31 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
qvvqRFBMcsZ1DbZeV714nC1bZeTBTI8wz52fv3nmAtP4P2M9TQlGKQ==
getuidj
secure.adnxs.com/
11 B
812 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Mar 2023 20:16:44 GMT
AN-X-Request-Uuid
86a2d4bd-ed94-4745-9789-a0a5cdab04d5
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zscaler.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
81.95.5.35; 81.95.5.35; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
202 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.zscaler.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
14 B
302 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a:39e::1c91 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
def9a88d4a332592de159183fb036d27d6a7fe94bfd472b69bd694a35201e8d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.zscaler.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:2b::3
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466196_1600460636_3550730099_17_654_12_0";dur=1
content-length
14
expires
Wed, 08 Mar 2023 20:16:44 GMT
gif.gif
ibc-flow.techtarget.com/a/
43 B
468 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2334982&r=1678306604865&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&version=2.4
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
2334982
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
via
1.1 google
x-guploader-uploadid
ADPycdsms0kuVWdrZtro-SI01KuzT3E7i7I8xT1lp-1Za7TgyLxt3QPxdlbJhHiAkJlySQCdcuLV8NAl5nMe4outtKMA30gZIMg4
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Wed, 08 Mar 2023 21:16:45 GMT
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2334982&r=1678306604865&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 08 Mar 2023 20:16:44 GMT
expires
Wed, 08 Mar 2023 20:16:44 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
ADPycdvfQR_RXKYuSiPSRyBnyCDbK_eR6gGeY03I0DJrzJcPrcLk48euh0BOy6-QfWZfAmUEciCAz5stmiQXMIPTdGihZzhMAH9A
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=772013321.1678306604&jid=479231227&_u=YGDACEABBAAAAGAAI~&z=1982993483
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-6177009-1&cid=772013321.1678306604&jid=479231227&_u=YGDACEABBAAAAGAAI~&z=1982993483
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/
0
0
Fetch
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by
Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
application/json
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
server
Google Frontend
x-powered-by
Express
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
access-control-allow-methods
GET, POST
content-type
text/html
access-control-allow-origin
*
x-cloud-trace-context
3d015aa5e3abccea13796c071402e022
function-execution-id
t6wdtt9no7yb
access-control-allow-headers
Content-Type, Accept
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame
0
0
Preflight
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type, Accept
access-control-allow-methods
GET, POST
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
22
content-type
text/html; charset=utf-8
date
Wed, 08 Mar 2023 20:16:44 GMT
etag
W/"2-ROqGvmcGDXooyAXFZHZ+i4au1yQ"
function-execution-id
rghv5xgni9h5
server
Google Frontend
x-cloud-trace-context
3ae7e48a5182c8d209c2356bfe69910c
x-powered-by
Express
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash
09d1b594af19e7be01e17cb45688c298dfb90a78fb9f6b8649b10212729eb698

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
x-amzn-trace-id
Root=1-6408ed2d-1c3ccb627ec40270058e2d07;Sampled=0
x-amzn-requestid
2a8f56b7-7616-4a6f-9c56-8f2bc0dff631
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Ben_MGu8vHcFh5w=
content-length
1406
x-amz-cf-id
Pb6pBGFB13g2OPSIXJbCLds6O8OKGeJuDGS7sUl17H_e951Jz63CUw==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:16:45 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-apigw-id
Ben_IGrIvHcF5Xg=
x-amz-cf-id
noY5eu7tljbQCVF7g6ZqVjpEj4xENubgAIpuz8tDXp3GaAcSfwA6AQ==
x-amz-cf-pop
PRG50-C1
x-amzn-requestid
19702fff-4b2d-4947-94de-2e4370f7add3
x-cache
Miss from cloudfront
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash
43adc6547c251a71ae7b43b6940c4e58468a30f57e735ba59a34bbfacedec37d

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
x-amzn-trace-id
Root=1-6408ed2d-3696af913597faaa1da07855;Sampled=0
x-amzn-requestid
9ff8b1be-17f9-4907-b1a3-7742c3de7ceb
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Ben_MElVPHcFf3g=
content-length
1406
x-amz-cf-id
YnIa7SajxtwCo8TQfbONueKWWc-jTS7ssdHfWTwtqImsdR4CAN9DtA==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:16:45 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-apigw-id
Ben_IH1BPHcFy7A=
x-amz-cf-id
EolsLs-Zz26OWYZfdAdmlODZYPyh1Fh-k4qDrMbzoclMpKMNwk60ow==
x-amz-cf-pop
PRG50-C1
x-amzn-requestid
4b03b382-13eb-434f-9f4f-c62614d50558
x-cache
Miss from cloudfront
26354555.js
bat.bing.com/p/action/
0
137 B
Script
General
Full URL
https://bat.bing.com/p/action/26354555.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Wed, 08 Mar 2023 20:16:44 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 8B0EE021CB554521935C885385D3EDDD Ref B: FRA31EDGE0117 Ref C: 2023-03-08T20:16:44Z
x-powered-by
ARR/3.0
x-cache
CONFIG_NOCACHE
munchkin.js
munchkin.marketo.net/162/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.87.143.22 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-87-143-22.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Wed, 08 Mar 2023 20:16:45 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4677
Expires
Fri, 16 Jun 2023 20:16:45 GMT
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1778897272132032&ev=PageView&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&rl=&if=false&ts=1678306604941&sw=1600&sh=1200&v=2.9.98&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1678306604939.965085647&it=1678306604733&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Wed, 08 Mar 2023 20:16:44 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.google.com/pagead/1p-user-list/812494211/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/812494211/?random=1678306604826&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1979771037&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/812494211/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/812494211/?random=1678306604826&cv=11&fst=1678305600000&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&tiba=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1979771037&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
492 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A44%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2008%20Mar%202023%2020%3A16%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22ab9750bca4342498694e239e304dd3a9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2008%20Mar%202023%2020%3A16%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2008%20Mar%202023%2020%3A16%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
ULSJHTPGTZGY3EPPZSKHKS
d.adroll.com/consent/check/
463 B
556 B
Script
General
Full URL
https://d.adroll.com/consent/check/ULSJHTPGTZGY3EPPZSKHKS?pv=47294649457.266624&arrfrr=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&_s=a672f542b260febc37d7c214da8b9070&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe05:9cc8:844:a82b:f09c Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
02cf5cdf7c8200c7a0a46b351644ecc2b3ddc4b7f39ce35d8ec391b4b26b45c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
server
nginx/1.22.1
content-length
463
content-type
application/javascript
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2b%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
visitWebPage
306-zej-256.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://306-zej-256.mktoresp.com/webevents/visitWebPage?_mchNc=1678306605024&_mchCn=&_mchId=306-ZEJ-256&_mchTk=_mch-zscaler.com-1678306605024-25497&_mchHo=www.zscaler.com&_mchPo=&_mchRu=%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Wed, 08 Mar 2023 20:16:45 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
e4e83be2-6d99-46ef-b8a8-b48b9c6640ff
oribili.js
cdn.linkedin.oribi.io/33962/
72 KB
24 KB
Script
General
Full URL
https://cdn.linkedin.oribi.io/33962/oribili.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:5600:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
9425e201802508d3508b64c3a5d9e7443d268271ed9536a5fadc2961ec633afa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:12:23 GMT
content-encoding
gzip
via
1.1 a60a14dea4b4a9f77d34297a625f2e24.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
age
262
vary
accept-encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript;charset=UTF-8
cache-control
public, max-age=300
x-amz-cf-id
AwdZ5wltW5i-SkUiKNxFAGfJ1AsZA7E0jLRtdjYeR-TRycx5iXICcw==
b2b0f36b-cd4e-488c-bdf2-5dc5da00234c
https://www.zscaler.com/
43 B
0
Image
General
Full URL
blob:https://www.zscaler.com/b2b0f36b-cd4e-488c-bdf2-5dc5da00234c
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
event
gw.linkedin.oribi.io/
0
186 B
XHR
General
Full URL
https://gw.linkedin.oribi.io/event
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.214.245.73 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-214-245-73.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.zscaler.com
date
Wed, 08 Mar 2023 20:16:45 GMT
access-control-allow-credentials
true
content-length
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain
/
px.ads.linkedin.com/ws_collect/
0
279 B
Image
General
Full URL
https://px.ads.linkedin.com/ws_collect/?pid=33962&timestamp=1678306605208&raw_event_id=33962-42b8b062-6f43-9c9a-557b-e2c15653051f-1678306605203
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:44 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: ACB50A4BC2B94DBBB639A96E0FFE0E19 Ref B: FRAEDGE1117 Ref C: 2023-03-08T20:16:45Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2aTUIMOcGP/cUIVAuWA==
MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
lh4.googleusercontent.com/
33 KB
33 KB
Image
General
Full URL
https://lh4.googleusercontent.com/MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
a8079038523e0b4ee4788120fe71f2132b3fdb347428f1f9dd365fecbb794622
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 17:40:22 GMT
x-content-type-options
nosniff
age
9383
content-disposition
inline;filename="onenote.JPG"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33364
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Thu, 02 Mar 2023 23:08:23 GMT
st
px.mountain.com/
2 KB
2 KB
Script
General
Full URL
https://px.mountain.com/st?ga_tracking_id=UA-6177009-1&ga_client_id=772013321.1678306604&shpt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-6177009-1%22%2C%22ga_client_id%22%3A%22772013321.1678306604%22%2C%22shpt%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%2C%22dcm_cid%22%3A%22undefined.undefined%22%2C%22dcm_gid%22%3A%221346087424.1678306604%22%2C%22mntnis%22%3A%7B%7D%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=undefined.undefined&dcm_gid=1346087424.1678306604&dxver=4.0.0&shaid=32329&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=94496331094753460term%3Dvalue&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Clanguage%3Den&shoid=%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution
Requested by
Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=94496331094753460term=value
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.37.218.4 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-37-218-4.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
622c2ccb9ea519067b72c2ba6962d04f67cc387b5d5fd4ed572a6e386c0406c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:46 GMT
content-encoding
gzip
server
istio-envoy
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
x-envoy-upstream-service-time
1
connection
close
/
www.facebook.com/tr/ Frame FF75
0
72 B
Document
General
Full URL
https://www.facebook.com/tr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.zscaler.com
Referer
https://www.zscaler.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.zscaler.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Wed, 08 Mar 2023 20:16:45 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
lh4.googleusercontent.com/
33 KB
33 KB
Image
General
Full URL
https://lh4.googleusercontent.com/MjasQwtK_pCq1e81fHkq_e5_tcB2fwN8rFcyL8m9s_7xq6RCRu4nGgxOgtct6WcVdGRCX4qmbaDqF_SMYrWqQsdU5FP8wlVRiwfvQiWlJhwBmbhiGoTt1t0Wx5gYaidF79nHXvz9lKu2dMnFrSFrULA
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
a8079038523e0b4ee4788120fe71f2132b3fdb347428f1f9dd365fecbb794622
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 17:40:22 GMT
x-content-type-options
nosniff
age
9383
content-disposition
inline;filename="onenote.JPG"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33364
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Thu, 02 Mar 2023 23:08:23 GMT
zscaler-promo-thumb-modernWorkEnab.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/
8 KB
8 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/zscaler-promo-thumb-modernWorkEnab.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85813f6ca8ca7fc81a8ae31d69ac4254d0b4dda08b70f4fe8f2056fda3a0c78f
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
7981
cf-resized
internal=ok/h q=0 n=18+0 c=1+316 v=2023.1.3 l=7981
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cfpZJntobpwrJ6bj4p00dlw3qa1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1fc8d9d9134-FRA
queue
st.fullcircleinsights.com/v1/visits/
2 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash
56482bed67599fbd8b57229e35170fca05ad87fdce3ab4ee1e74faa4ae9b6923

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:16:46 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
x-amzn-trace-id
Root=1-6408ed2e-1ed99ecd1a96e093532d0bf9;Sampled=0
x-amzn-requestid
a366a35f-8b93-456c-af06-dea02ecf2ebe
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Ben_WE-ePHcFa1w=
content-length
2050
x-amz-cf-id
VVaS0nQhTDc6f3cZJ6yWkCisf_7KbY3fXV0Siz97w7_7zuJlA9lvtA==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:16:46 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-apigw-id
Ben_QGSVPHcFTjw=
x-amz-cf-id
i2MT81eChPWJlRN3ToG9nArKOpl85be8Wcq7oX0nODvla4qdSvKjqg==
x-amz-cf-pop
PRG50-C1
x-amzn-requestid
554fc815-afe9-430d-8792-e2f828d4681a
x-cache
Miss from cloudfront
zscaler-promo-thumb-modernWorkEnab.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/
8 KB
8 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blocks/menu-promo/zscaler-promo-thumb-modernWorkEnab.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_qwZPVS2fbAHeIkMeX_pN7EbF_qjC7NqNXNO4VzhjMIs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1c4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85813f6ca8ca7fc81a8ae31d69ac4254d0b4dda08b70f4fe8f2056fda3a0c78f
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:45 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
7981
cf-resized
internal=ok/h q=0 n=18+0 c=1+316 v=2023.1.3 l=7981
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"cfpZJntobpwrJ6bj4p00dlw3qa1gWqs-rDoNB_ezzVDQ"
vary
Accept, Accept-Encoding
content-type
image/avif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7a4dc1fd3f039134-FRA
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A44%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:46 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
queue
st.fullcircleinsights.com/v1/visits/
2 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash
4959ae91d09f3df74b28290e242a1181a63cd65c2d42b3093f727c083f5bef5f

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:16:46 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
x-amzn-trace-id
Root=1-6408ed2e-394d49db4c7a997748d71fcc;Sampled=0
x-amzn-requestid
0017c78b-37a2-4005-aa57-3370fb0da10f
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Ben_VEQyPHcFuOw=
content-length
2050
x-amz-cf-id
vaTiGb0VZqMtCSlrytHQ4bpVnUBlz8QwdzPia3J2Ac0EiToJmDJHZg==
queue
st.fullcircleinsights.com/v1/visits/
2 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash
dbe61790688bbd75e1b6aed7b177ffadc6747bdc33890bbe0d3523eccff447fa

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 08 Mar 2023 20:16:47 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
x-amzn-trace-id
Root=1-6408ed2f-49bda940294abff44a20ce93;Sampled=0
x-amzn-requestid
eff60216-0b0e-4efa-a8c2-b4263687e32f
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Ben_aFAxvHcFq8Q=
content-length
2050
x-amz-cf-id
-G0Xgkf4aeZ17D66BSejs3_G5JjBNIIC5ZnkhTwSWJjRIjosj3_fGA==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:16:46 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-apigw-id
Ben_TFT0PHcFbTw=
x-amz-cf-id
-Lu8vovh7hwENonIjE5wM7IylQHhgW_vPUPVqKiY6s1HzPF3V3OCVg==
x-amz-cf-pop
PRG50-C1
x-amzn-requestid
63881ef2-f018-4087-9b6c-24ec7fc212b0
x-cache
Miss from cloudfront
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-10.prg50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Wed, 08 Mar 2023 20:16:46 GMT
via
1.1 d05dc840d6cf3901928326ad8b6d38c2.cloudfront.net (CloudFront)
x-amz-apigw-id
Ben_TEmmPHcFhaA=
x-amz-cf-id
6M8tSXFZMGtjYchV1C2SVbyQKocoljQeO-Y0cw6hvJBZQIC9Ezl7pA==
x-amz-cf-pop
PRG50-C1
x-amzn-requestid
3979870c-2d75-441a-a911-7fbe2812d363
x-cache
Miss from cloudfront
gs
gs.mountain.com/
144 B
733 B
Script
General
Full URL
https://gs.mountain.com/gs
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
82e7ecc148b5caf33ade4e048a4d30ef0297c02cb263e8bb469a8f4ae4a98945

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:47 GMT
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
istio-envoy
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
cache-control
public, max-age=31536000
x-envoy-upstream-service-time
2
connection
close
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
content-length
144
x-application-context
application:prod:8080
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A45%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:47 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
st
px.mountain.com/
5 KB
2 KB
Script
General
Full URL
https://px.mountain.com/st?ga_tracking_id=UA-6177009-1&ga_client_id=772013321.1678306604&shpt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-6177009-1%22%2C%22ga_client_id%22%3A%22772013321.1678306604%22%2C%22shpt%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%2C%22dcm_cid%22%3A%22undefined.undefined%22%2C%22dcm_gid%22%3A%221346087424.1678306604%22%2C%22mntnis%22%3A%7B%7D%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=undefined.undefined&dcm_gid=1346087424.1678306604&dxver=4.0.0&shaid=32329&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Clanguage%3Den&shoid=%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=1678306606405860&shguid=df4a510b-b92b-3974-9e6e-d458a163f315&shgts=1678306607186
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.37.218.4 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-37-218-4.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
07caee28080a161e24c687ebe75c1d89334e3a6686cd47f2d4b3f7e6395f3b01

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:47 GMT
content-encoding
gzip
server
istio-envoy
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
x-envoy-upstream-service-time
12
connection
close
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A46%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:48 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A47%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224011%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:49 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je3360&_p=1054683009&cid=772013321.1678306604&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sid=1678306604&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&dt=OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution&_s=2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 08 Mar 2023 20:16:49 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A48%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:50 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
492 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A49%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:51 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A50%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%227020%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:52 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A51%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%228023%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:53 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A52%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%229025%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:54 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=1b85f230-983a-4b13-8fc2-325543761880&session=2082cb38-5af9-4121-80df-d3a72fb8523e&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2008%20Mar%202023%2020%3A16%3A53%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%2210029%22%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabz%20team%20observed%20multiple%20OneNote%20malware%20campaign%20spreading%20RATs%2C%20Bankers%2C%20and%20Stealer%20category%20malware%20with%20multi-layer%20obfuscation.%22%2C%22keywords%22%3A%22OneNote%2CQakbot%2C%20RATs%2C%20Bankers%2CStealer%2CThreat%2CCybersecurity%2CInfosec%2CSecurity%2CThreat%20Hunt%2C%20Treat%20Intel%2CCampaign%2C%20Redline%2C%20IcedID%2CCrypter%2CObfuscation%2C%20Cobalt%20Strike%2C%20Async%20RAT%2CYouhacker%20Crypter%2CYouhacker%20Stealer%22%2C%22title%22%3A%22OneNote%3A%20A%20Growing%20Threat%20for%20Malware%20Distribution%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&pageViewId=5925fe60-1fd6-4d6a-8c81-2d7fc16e2f50&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 20:16:55 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

114 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| OneTrustStub function| OptanonWrapper string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData function| ownKeys function| _objectSpread function| _defineProperty function| $ function| attachFailoverAssets function| jQuery object| drupalSettings object| Drupal function| dBlazy function| Bio function| BioMedia object| tabbable function| Popper object| Cookies object| APP object| UTIL object| IPv6 object| punycode object| SecondLevelDomains function| URI function| URITemplate object| lazySizes function| Sifter object| MicroPlugin function| Selectize object| MktoForms2 function| _toConsumableArray function| _nonIterableSpread function| _unsupportedIterableToArray function| _iterableToArray function| _arrayWithoutHoles function| _arrayLikeToArray function| exposedFiltersUi object| bootstrap object| _wq object| zsForms object| Optanon object| OneTrust object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| GooglebQhCsO string| GoogleAnalyticsObject function| ga function| doMarketoGASetup function| onYouTubeIframeAPIReady function| addCaptchaScript object| jQuery112405821815341940071 object| _utm_data object| utm_data function| process6senseData object| _6si string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _linkedin_data_partner_id function| fbq function| _fbq object| techtargetic function| pdst number| sf14gv object| gaplugins object| gaGlobal object| gaData function| lintrk boolean| _already_called_lintrk object| Bizible object| BizTrackingA object| BizA object| _vis_opt_queue object| LC_API object| $jscomp object| fcdsc function| fcdscLoad function| ES6Promise function| gtag string| adroll_sid object| adroll object| __adroll boolean| adroll_optout object| adroll_loaded object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback function| UET function| UET_init function| UET_push object| ueto_eb23bf5ff9 object| uetq function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| adroll_exp_list object| __adroll_consent_data object| MunchkinTracker boolean| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| ORIBILI string| dcm_cid undefined| dcm_tid undefined| dcm_gid object| irongate object| mntn

36 Cookies

Domain/Path Name / Value
.info.zscaler.com/ Name: __cf_bm
Value: W6fYWzJ8Tp0tuFTmt7U9cTntjSAAbZ_z0xMPwY4YIxg-1678306603-0-AZbih8y6E1VFysrMj0tULZXipF3YV+9QDoW/yFU5Oo8aWjXvHI7p7s3uudqqoZpxnDVi6kqcdivAYvEask+072E=
.zscaler.com/ Name: _gcl_au
Value: 1.1.1555387113.1678306604
.www.zscaler.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Wed+Mar+08+2023+20%3A16%3A44+GMT%2B0000+(GMT)&version=6.39.0&isIABGlobal=false&landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0&hosts=H36%3A1%2CH59%3A1%2CH109%3A1%2CH45%3A1%2CH46%3A1%2CH100%3A1%2CH82%3A0%2CH106%3A0%2CH116%3A0%2CH4%3A0%2CH102%3A0%2CH76%3A0%2CH103%3A0%2CH60%3A0%2CH96%3A0%2CH20%3A0%2CH22%3A0%2CH97%3A0%2CH98%3A0%2CH108%3A0%2CH65%3A0%2CH83%3A0%2CH110%3A0%2CH111%3A0%2CH112%3A0%2CH114%3A0%2CH101%3A0%2CH52%3A0%2CH104%3A0%2CH105%3A0%2CH14%3A0%2CH15%3A0%2CH17%3A0%2CH113%3A0%2CH115%3A0&genVendors=
.zscaler.com/ Name: _gid
Value: GA1.2.1346087424.1678306604
.zscaler.com/ Name: _dc_gtm_UA-6177009-1
Value: 1
info.zscaler.com/ Name: BIGipServerabmweb-nginx-app_https
Value: !gPI4VyshKeR38mWbudb4AMywNyDldVEc1mWPVOX9Nk+38cEScahB1Z+MB0Gl5qIOY0oyJu1G+5LGRw==
.techtarget.com/ Name: __cf_bm
Value: QvXiMs9h4Fza2SCaYa4uEp0y5Mdiy.4RQEDMMkXvEfc-1678306604-0-AV4KICf78zc9JEU5+P5LEuh5yMq6bEEPMzAW7CMqopk5F+3s+BoC+H/4mlvlanLjFygBz6Y/RncmPV6NYM3fbtE=
.zscaler.com/ Name: _gat_UA-6177009-1
Value: 1
.zscaler.com/ Name: _ga
Value: GA1.1.772013321.1678306604
.zscaler.com/ Name: _ga_10SPJ4YJL9
Value: GS1.1.1678306604.1.0.1678306604.60.0.0
www.zscaler.com/ Name: __pdst
Value: 962406424b684709a9742e854b3b60cb
.zscaler.com/ Name: _biz_uid
Value: 1468c90a4cb54f1ad08869cf6f1225da
.zscaler.com/ Name: _biz_sid
Value: 6b3bdd
.zscaler.com/ Name: _biz_nA
Value: 1
.zscaler.com/ Name: _biz_pendingA
Value: %5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D1468c90a4cb54f1ad08869cf6f1225da%26_biz_s%3D6b3bdd%26_biz_l%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fonenote-growing-threat-malware-distribution%26_biz_t%3D1678306604778%26_biz_i%3DOneNote%253A%2520A%2520Growing%2520Threat%2520for%2520Malware%2520Distribution%26_biz_n%3D0%26rnd%3D208732%22%5D
.zscaler.com/ Name: _fcdscst
Value: MTY3ODMwNjYwNDc5Mg==
.zscaler.com/ Name: _uetsid
Value: 2598f4d0bdee11ed861b7febbdd76a18
.zscaler.com/ Name: _uetvid
Value: 25995140bdee11ed931b1f45aeb54682
.doubleclick.net/ Name: IDE
Value: AHWqTUkju5luHSpVkvw5ihdU8zR1sZDpNoylqTL1yNkXYftCfFFSTf24OZeCZYD8
.linkedin.com/ Name: UserMatchHistory
Value: AQLejXKH2WryPgAAAYbC3nc8kWjICCRCTBVAtbZP9YXMW6KHH1BIgyjjuALbwn5rW7Jty5bWlrD6zA
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLwOYbaybr2QQAAAYbC3nc8t5DThtROUR-EXWGke2yPF5nDD2s0u1uO__hGp3q3ULokvTFoS65qQGhl1cALVg
.linkedin.com/ Name: bcookie
Value: "v=2&2308a582-f016-4076-8828-c3fea97f22fb"
.linkedin.com/ Name: lidc
Value: "b=VGST03:s=V:r=V:a=V:p=V:g=2809:u=1:x=1:i=1678306604:t=1678393004:v=2:sig=AQGsRlqmB2IawRduTVIl-NpHZkzdNTdE"
.zscaler.com/ Name: _fbp
Value: fb.1.1678306604939.965085647
www.zscaler.com/ Name: _an_uid
Value: 0
www.zscaler.com/ Name: _gd_visitor
Value: 1b85f230-983a-4b13-8fc2-325543761880
www.zscaler.com/ Name: _gd_session
Value: 2082cb38-5af9-4121-80df-d3a72fb8523e
.zscaler.com/ Name: _mkto_trk
Value: id:306-ZEJ-256&token:_mch-zscaler.com-1678306605024-25497
www.zscaler.com/ Name: ln_or
Value: eyIzMzk2MiI6IjMzOTYyIn0%3D
.zscaler.com/ Name: oribili_user_guid
Value: 36e570fb-26fc-eb57-c2d5-c8e2bc37981e
.6sc.co/ Name: 6suuid
Value: 94f010028b9f00002ded0864d4000000ce001700
.linkedin.com/ Name: li_gc
Value: MTswOzE2NzgzMDY2MDU7MjswMjGxEtuJBIahDUb9mRdFXO9XRrraXaVQwcTPsXJXyb2M+g==
.mountain.com/ Name: guid
Value: 267e984d-bdee-11ed-a9aa-b5ecb449c955
.zscaler.com/ Name: _fcdscv
Value: eyJDdXN0b21lcklkIjoiNzMxYzMxNmEtYzQ2ZS00YTk0LTgxYTktN2NmYzBlYTBkNTNlIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiIwNjc5ZGY0My04NWFhLTRkOTAtOWJhZS0wZjQ3Njk2NjFkZmEifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==
.px.mountain.com/ Name: tt
Value: "H4sIAAAAAAAAAKtW8guKNzYyNrKMN7IwtlCyMtBBEjG3NAaLICswNDO3MDYwMzMwNze01FEqU7IyqgUAzvclJ0YAAAA="
.mountain.com/ Name: rt
Value: "MzIzMjk6MTY3ODMwNjYwNw=="

5 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://t.sf14g.com/sf14g.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1678306604743%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fonenote-growing-threat-malware-distribution%26liSync%3Dtrue
Message:
Failed to load resource: the server responded with a status of 429 ()
security error URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=94496331094753460term=value
Message:
Refused to connect to 'https://52.71.121.170/is' because it violates the following Content Security Policy directive: "connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251".
javascript error URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fonenote-growing-threat-malware-distribution&cb=94496331094753460term=value
Message:
Refused to connect to 'https://52.71.121.170/is' because it violates the document's Content Security Policy.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com; img-src 'self' https: data: blob:; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM testmydefenses.com
X-Xss-Protection 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

306-zej-256.mktoresp.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdn.pdst.fm
connect.facebook.net
d.adroll.com
d2i34c80a0ftze.cloudfront.net
dx.mountain.com
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
gw.linkedin.oribi.io
ibc-flow.techtarget.com
info.zscaler.com
ipv6.6sc.co
j.6sc.co
lh4.googleusercontent.com
munchkin.marketo.net
px.ads.linkedin.com
px.mountain.com
region1.analytics.google.com
s.adroll.com
secure.adnxs.com
snap.licdn.com
st.fullcircleinsights.com
stats.g.doubleclick.net
t.sf14g.com
trk.techtarget.com
us-central1-adaptive-growth.cloudfunctions.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.zscaler.com
104.17.74.206
104.87.143.22
152.195.15.58
184.24.7.242
192.28.144.124
2001:4860:4802:32::36
2001:4860:4802:36::36
2600:9000:2127:3000:6:9280:1080:93a1
2600:9000:2127:5600:2:53b2:240:93a1
2600:9000:2127:c00:9:14eb:6280:93a1
2606:4700:4400::ac40:9062
2606:4700::6812:1c4a
2606:4700::6812:d9f
2606:4700::6813:bc61
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:800::2001
2a00:1450:4001:810::2003
2a00:1450:4001:810::200e
2a00:1450:4001:811::2008
2a00:1450:4001:82b::2002
2a00:1450:400c:c09::9c
2a00:1450:400d:807::2004
2a02:26f0:11a:39e::1c91
2a02:26f0:3500:16::215:14a0
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:d018:cc3:fe05:9cc8:844:a82b:f09c
3.214.188.44
34.111.208.231
34.214.245.73
35.244.142.80
35.81.162.201
37.252.171.53
44.209.137.118
52.37.218.4
65.9.95.10
0026207a95ec76029445ec7fd6eda7a06dfb1778cb84464e36f661711db17ea4
02cf5cdf7c8200c7a0a46b351644ecc2b3ddc4b7f39ce35d8ec391b4b26b45c7
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
07caee28080a161e24c687ebe75c1d89334e3a6686cd47f2d4b3f7e6395f3b01
08ac0b1c6a749cc1b5e6e71fe2be06b21a3b304e8ca577c6a5349e5609963aec
09d1b594af19e7be01e17cb45688c298dfb90a78fb9f6b8649b10212729eb698
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f7832c8054c16e592d3697f5612969b692ac94197aa591b5487795f7c928c1b
0fca0294cfaf24a4db0852415eee7bcdea7b9766d59e443fb2d5f0c77eb23363
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
1ae740ebbe1a0c68cdf60b2d5df40126d47e6c69d19bf794b8a99ad5ceb81992
1c2b18b909fd895ea5ca754507cb84b94d0a35ec1e1520bd67a5446906268564
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2aaa0eac6ba23ee39304a3badfb67a930293225d20cd99538e0064186ca3ee91
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
345771b135821e8ea4462d4ab1ac33604e66b0769e4d3cefe885b4ecbca51ea7
359b1185178b99c26c1efb30a1a9b75e0cb5aa0abcf637affbe62c4dfa0ca19f
3fba09ed466b1934699b1f3f7d487d3799c3db8bc7ff5ec6bb2ff107bc86a0fb
43adc6547c251a71ae7b43b6940c4e58468a30f57e735ba59a34bbfacedec37d
4959ae91d09f3df74b28290e242a1181a63cd65c2d42b3093f727c083f5bef5f
49ae74412b388787f2247d5ce9809c636a7e8768025dd67013fc0c9188526b52
4bceb9f32efde2d668a8d95c0a9ac403bb83e3fd48e8d4b91bda4855910963fc
56482bed67599fbd8b57229e35170fca05ad87fdce3ab4ee1e74faa4ae9b6923
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5d23676da3d5b10007f7f675da723f274604cd88397dc25c4721519973994a71
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
622c2ccb9ea519067b72c2ba6962d04f67cc387b5d5fd4ed572a6e386c0406c1
69fe3a3cb8e52c9522e1317a41bfda30f19e6c199fb84c66f083cd9e35e46442
6ecf1827dde90b8cecee9b85e645622b51e69b12b2ba1ae4d484fc0b9ef2f842
79e40ce5098ca3d5d3ed476b2b4e156829bdec21fb8c07bab967f6525f5c5677
80453cb0a63879a2b1427acf4847d5c93e0aed56b8e0c5b603229efccbb1dd19
82e7ecc148b5caf33ade4e048a4d30ef0297c02cb263e8bb469a8f4ae4a98945
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
841d0c87a0e119520d9786d40e294123ec78a72b4c1c3578882f9dfd81c95539
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85813f6ca8ca7fc81a8ae31d69ac4254d0b4dda08b70f4fe8f2056fda3a0c78f
8d1f4dc8f57f1369b2c6e76000c2aa140c684b60459c7f09f4baa7103d14b8a8
9425e201802508d3508b64c3a5d9e7443d268271ed9536a5fadc2961ec633afa
9581d252706f6236028acf67e89cd0c2f8ec64ff46a416bf384b2fd3876080d4
979fad71a30e04878ea6f208924e89593d93fac949e1ddcdd824e265d840b32e
99b5a6256a9ee7c2640c2669ed517975bfb713b36dc3dde5c55b3c2c85885f4c
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253
a8079038523e0b4ee4788120fe71f2132b3fdb347428f1f9dd365fecbb794622
a83018a0ad67600ad05abd4fb02932d92e620f065ea461628d51607b644bd363
ab064f552d9f6c01de22431e5ffa4dec46c5fea8c2ecda8d5cd3b8573863308b
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
b676116353f4fc61b28c4305cd66e29e6425b9718b21ea0341987db6aa0850f4
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
c3d28c70f877331d163f4ce3465faea62cbd7658e40337a90ccbe8b1f3da16ff
c589a912b24ef0609b0f6fe12718d82a82a600a5d9ce212f658e51d642cedff7
c7cfd5dc386d092ab9afb5af683856ed88121e55e6bf1024333c3151ccc46e36
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
cc61567118cf364a9ecf1106fc903b48222916262e036b48db3145167d5aa2d3
d9b3ce107ec44b1244cb53d0b7ed01a9abcfc84573daa0b50d078003388c1248
da9a77e15c8cbf2596563d3bc8020cc9e547d2b99976a0b77f5eeadf1c492feb
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dbe61790688bbd75e1b6aed7b177ffadc6747bdc33890bbe0d3523eccff447fa
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
def9a88d4a332592de159183fb036d27d6a7fe94bfd472b69bd694a35201e8d6
df26e59b0ea17beea7651010590153fdbee9f22a8d12315e8e9c3cc6973fcb22
dfd8136322c3df6d16bc5e48910712cb01c53d7f63d40cb0537c00389cb1aec4
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2ca5ac3d9cf4d005d7294562694e44b40efd2c194722721a52743c2f43f1a6
ef401955627aaaedffd337dc3a7c4f9ad56f5dcd31f13833772760cda1aaa437
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fb71a91ef4937bdac04520d7e7b1852bb28635ae850934d440360ccc8142c1a4
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe40bb752bab0a83fce103714fcd294ebc51314978fd77c81fe1842d1452df80