urlscan.io logo urlscan.io
SecurityTrails logo

www.forcepoint.com Open in urlscan Pro
2a04:4e42:600::740  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks
Effective URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Submission: On November 18 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 36 HTTP transactions. The main IP is 2a04:4e42:600::740, located in United States and belongs to FASTLY, US. The main domain is www.forcepoint.com. The Cisco Umbrella rank of the primary domain is 386660.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on November 6th 2024. Valid for: a year.
This is the only time www.forcepoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 25 2a04:4e42:600... 54113 (FASTLY)
1 2600:9000:235... 16509 (AMAZON-02)
10 2620:12a:8001::4 54113 (FASTLY)
36 4
Apex Domain
Subdomains		 Transfer
25 forcepoint.com
www.forcepoint.com — Cisco Umbrella Rank: 386660
8 MB
10 pantheonsite.io
live-forcepoint-drupal.pantheonsite.io
11 KB
1 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1341
10 KB
0 neverbounce.com Failed
cdn.neverbounce.com Failed
36 4
Domain Requested by
25 www.forcepoint.com 1 redirects www.forcepoint.com
10 live-forcepoint-drupal.pantheonsite.io www.forcepoint.com
1 tags.tiqcdn.com www.forcepoint.com
0 cdn.neverbounce.com Failed www.forcepoint.com
36 4
Subject Issuer Validity Valid
forcepoint.com
Sectigo RSA Organization Validation Secure Server CA		 2024-11-06 -
2025-11-06		 a year crt.sh
tags.tiqcdn.com
Amazon RSA 2048 M02		 2024-03-19 -
2025-04-17		 a year crt.sh
pantheonsite.io
R11		 2024-11-18 -
2025-02-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Frame ID: FE27B9378619E246F87B8C9121D8E664
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Using C# for post-PowerShell attacks - en

Page URL History Show full URLs

  1. https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks HTTP 307
    https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks Page URL

Page Statistics

36
Requests

97 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

7721 kB
Transfer

11159 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks HTTP 307
    https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request using-c-post-powershell-attacks
www.forcepoint.com/blog/x-labs/
Redirect Chain
  • https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks
  • https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
282 KB
39 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare / Next.js
Resource Hash
0f773f254ebb4056825f24e4b590e44364293d423b75f53b3015964bf5d2ceed
Security Headers
Name Value
Content-Security-Policy frame-ancestors self https://*.forcepoint.com https://*.pantheonsite.io
Strict-Transport-Security max-age=300

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
private, no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8e4a60e79a53d376-FRA
content-encoding
gzip
content-security-policy
frame-ancestors self https://*.forcepoint.com https://*.pantheonsite.io
content-type
text/html; charset=utf-8
date
Mon, 18 Nov 2024 19:31:07 GMT
expires
Mon, 18 Nov 2024 19:31:06 GMT
http_x_geo_continent
EU
http_x_geo_region
DE-HE
server
cloudflare
strict-transport-security
max-age=300
vary
Accept-Encoding
via
1.1 varnish, 1.1 varnish
x-cache
MISS, MISS
x-cache-hits
0, 0
x-compute
true
x-powered-by
Next.js
x-served-by
cache-fra-etou8220140-FRA, cache-fra-eddf8230051-FRA
x-timer
S1731958263.951471,VS0,VE4063

Redirect headers

accept-ranges
bytes
cache-control
public, s-maxage=300, stale-while-revalidate=600
cf-cache-status
DYNAMIC
cf-ray
8e4a60d53a8e8fd1-FRA
content-security-policy
frame-ancestors self https://*.forcepoint.com https://*.pantheonsite.io
content-type
text/html
date
Mon, 18 Nov 2024 19:31:02 GMT
http_x_geo_continent
EU
http_x_geo_region
DE-HE
location
/blog/x-labs/using-c-post-powershell-attacks
server
cloudflare
strict-transport-security
max-age=300
vary
Accept-Encoding
via
1.1 varnish, 1.1 varnish
x-cache
MISS, MISS
x-cache-hits
0, 0
x-cloud-trace-context
74914be8355f7d25e9528fcb47940375
x-compute
true
x-served-by
cache-fra-eddf8230024-FRA, cache-fra-eddf8230051-FRA
x-timer
S1731958260.011110,VS0,VE2928
fea3d4467cfa205e-s.p.woff
www.forcepoint.com/_next/static/media/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/media/fea3d4467cfa205e-s.p.woff
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52239b576d3fdb13fa5cec121a5e5ed123560a4ac1310d991f4694bcc5507710
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.forcepoint.com
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
MISS
etag
W/"4618-19326f6f678"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
font/woff
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230076-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
d12679d68ab423753c32e8013b3d438c
vary
Accept-Encoding
x-cache-hits
125, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.039942,VS0,VE10
via
1.1 varnish, 1.1 varnish
cf-ray
8e212755e99ddc62-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
17944
server
cloudflare
07994352d4c70274-s.p.woff
www.forcepoint.com/_next/static/media/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/media/07994352d4c70274-s.p.woff
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d88c03f60c9b0c3b3a4a929ad268b6078dda88e59ea5c98eeb16f031ffb0d9e0
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.forcepoint.com
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
MISS
etag
W/"4ba0-19326f6f678"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
font/woff
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220051-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
d24e9f96373481e1d3aec7365ae22552
vary
Accept-Encoding
x-cache-hits
109, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.041679,VS0,VE11
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127562a963a80-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
19360
server
cloudflare
91691a199189ad78-s.p.woff
www.forcepoint.com/_next/static/media/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/media/91691a199189ad78-s.p.woff
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5390daebe4fc263953ae2cd18f060ebb4aaef20d9df443a4d784cc642ed1eaf2
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.forcepoint.com
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
MISS
etag
W/"48a8-19326f6f678"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
font/woff
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230153-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
11da1efbcb5eb323a9c2cbac4d2db007
vary
Accept-Encoding
x-cache-hits
125, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.041365,VS0,VE17
via
1.1 varnish, 1.1 varnish
cf-ray
8e21275639bf9761-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
18600
server
cloudflare
ecd8412fec5af649-s.p.woff
www.forcepoint.com/_next/static/media/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/media/ecd8412fec5af649-s.p.woff
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8709e66f3192aac47989a4f2c826afc3062b52de3cd792115cba3314c05656c6
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.forcepoint.com
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
MISS
etag
W/"4cc8-19326f6f678"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
font/woff
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230059-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
e9c326c0301f3a2abc6c029a0942761a
vary
Accept-Encoding
x-cache-hits
125, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.042050,VS0,VE9
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127562b463689-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
19656
server
cloudflare
29455c8220dcbd16-s.p.woff
www.forcepoint.com/_next/static/media/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/media/29455c8220dcbd16-s.p.woff
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42793f24dc3fddca04cc84a6991f0fc73c25498d023b07d488dd5e4238ed9b0c
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.forcepoint.com
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
MISS
etag
W/"4804-19326f6f678"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
font/woff
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220122-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
40bd9229e240e52b0e389c0a4f69d2d4
vary
Accept-Encoding
x-cache-hits
109, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.040885,VS0,VE8
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127565af1d2c7-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
18436
server
cloudflare
de6f1cff9b375fcc-s.p.woff
www.forcepoint.com/_next/static/media/ 		18 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/media/de6f1cff9b375fcc-s.p.woff
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1524c7035a894f370d34f2d57704873a3978adef91d97978e3598515762eace
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.forcepoint.com
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
MISS
etag
W/"4900-19326f6f678"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
font/woff
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230035-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
c25c2fdee7463d034397357f3b61d0fb
vary
Accept-Encoding
x-cache-hits
125, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.040841,VS0,VE12
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127563be5dbff-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
18688
server
cloudflare
19f2c06837305887-s.p.woff
www.forcepoint.com/_next/static/media/ 		18 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/media/19f2c06837305887-s.p.woff
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.forcepoint.com
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
MISS
etag
W/"49b4-19326f6f678"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
font/woff
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230147-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
19c90f5ba7b4352c8ce180b9f79c6d42
vary
Accept-Encoding
x-cache-hits
126, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.040789,VS0,VE14
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127566e24a055-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
18868
server
cloudflare
54df1ed0eb2df70f.css
www.forcepoint.com/_next/static/css/ 		126 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/css/54df1ed0eb2df70f.css
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7bc82d52b9d6b5642f653a3abced989d08bfc77e4a4f2bf14185a6853071cabb
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"1f6dc-19326f6f674"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
text/css; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220046-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
115, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.039960,VS0,VE16
via
1.1 varnish, 1.1 varnish
cf-ray
8e21275618eb65aa-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
22112
server
cloudflare
utag.sync.js
tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/ 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:235a:2800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1f071a798b7ade7ea830012150e599450b358a284559d225f5c2b9408a602726

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

vary
accept-encoding
cache-control
max-age=300
content-encoding
br
etag
W/"eed47ad18f52ab09d14510202e80a47d"
x-amz-version-id
lGNEYrrsMQUj_rsmYfrBauvTwVbaRJBb
age
238
via
1.1 840e16b680c94fee8c48b15e01dda782.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
67Mgq2a3UI3QiNFFFjevPY1Xe5KfS_Ot9DAXrPSsdGrZnWfbxIhA2A==
date
Mon, 18 Nov 2024 19:27:10 GMT
content-type
application/javascript
last-modified
Wed, 13 Nov 2024 22:44:04 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P9
x-amz-server-side-encryption
AES256
NeverBounce.js
cdn.neverbounce.com/widget/dist/ 		0
0
webpack-59c5c889f52620d6.js
www.forcepoint.com/_next/static/chunks/ 		2 KB
1021 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/webpack-59c5c889f52620d6.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7082c98641f82287ee830bdef5ee7c447c042d01f42b0b0bdadd1b819fb0c93
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"646-19326f6f674"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230066-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
134, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.117432,VS0,VE16
via
1.1 varnish, 1.1 varnish
cf-ray
8e21275639105d9f-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
823
server
cloudflare
framework-5429a50ba5373c56.js
www.forcepoint.com/_next/static/chunks/ 		138 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/framework-5429a50ba5373c56.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a922d06946c153c130de6238a7d90e238f1341d19d42cee935017ad7495589e5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"226b8-19326f6f660"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230120-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
134, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.118386,VS0,VE25
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127565ca89205-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
45303
server
cloudflare
main-8eb5bfe75ec8ecab.js
www.forcepoint.com/_next/static/chunks/ 		124 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/main-8eb5bfe75ec8ecab.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cee1ea050594fbc4286dab81a1e54e7e257af74c362dd5000a07f6b2d516191
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"1eed5-19326f6f660"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230055-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
134, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.119031,VS0,VE100
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127564ef9bbcd-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
37226
server
cloudflare
_app-85d519b967e15aae.js
www.forcepoint.com/_next/static/chunks/pages/ 		10 MB
7 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/pages/_app-85d519b967e15aae.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b23bed5014767cbb946a2555da6ad0a18ea89ac71e7abd9a05402abdbbfba9cc
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"9bfbd4-19326f6f670"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220142-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
0, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.117906,VS0,VE15
via
1.1 varnish, 1.1 varnish
cf-ray
8e212756482d2bce-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
7416649
server
cloudflare
479-d7cf44e608456552.js
www.forcepoint.com/_next/static/chunks/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/479-d7cf44e608456552.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b3f346d149f1975ee2de68d155ad4131de2b22c62b9e7d9b2e5481349839b29
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"232f-19326f6f660"
x-compute
true
age
432276
expires
Thu, 13 Nov 2025 19:26:30 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230155-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
64, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.117965,VS0,VE34
via
1.1 varnish, 1.1 varnish
cf-ray
8e212761584c2c27-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
2180
server
cloudflare
311-46df1f0976b8d064.js
www.forcepoint.com/_next/static/chunks/ 		40 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/311-46df1f0976b8d064.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1416beb9d1c5f4217052c2c88fe77efded9407a22e12760baba651ea859caedb
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"9eb4-19326f6f660"
x-compute
true
age
432276
expires
Thu, 13 Nov 2025 19:26:30 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220028-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
0, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.117770,VS0,VE20
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127617f429bcb-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
10511
server
cloudflare
111-284a33706ce79ccb.js
www.forcepoint.com/_next/static/chunks/ 		77 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/111-284a33706ce79ccb.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
802d9342a8ee1b31e4f3ffeb1301d83fa469e4b5bc94d76f6e556f318ce8b702
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"13523-19326f6f660"
x-compute
true
age
415206
expires
Thu, 13 Nov 2025 19:26:30 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220048-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
0, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.117429,VS0,VE11
via
1.1 varnish, 1.1 varnish
cf-ray
8e21276169a9bb74-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
27178
server
cloudflare
52-45365220458d3e30.js
www.forcepoint.com/_next/static/chunks/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/52-45365220458d3e30.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74dde3ed216ca00112ca8bb243f0acdd5f92521ab3f86a93661f7cfa5ba8f124
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"3ae6-19326f6f660"
x-compute
true
age
432276
expires
Thu, 13 Nov 2025 19:26:30 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220138-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
0, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.118442,VS0,VE13
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127616f43a043-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
5517
server
cloudflare
343-6545c2c0ab157f05.js
www.forcepoint.com/_next/static/chunks/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/343-6545c2c0ab157f05.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a027c8cebff369b835d8d92ccdc126d12d4225c7db9e8debf238833c56b7ca2
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"28a4-19326f6f660"
x-compute
true
age
432276
expires
Thu, 13 Nov 2025 19:26:30 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220074-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
0, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.118077,VS0,VE20
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127616da1d2f2-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
3898
server
cloudflare
726-b141f5da0604ada7.js
www.forcepoint.com/_next/static/chunks/ 		46 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/726-b141f5da0604ada7.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08a1ba5b234dfdfd29f77c3a9250ae57d0cded23f6f3abdb2c90f018a1d28e70
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"b8c2-19326f6f660"
x-compute
true
age
432276
expires
Thu, 13 Nov 2025 19:26:30 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220136-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
0, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.117026,VS0,VE8
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127615b605d49-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
11996
server
cloudflare
%5B...slug%5D-7f5f3a1ccb3e38bb.js
www.forcepoint.com/_next/static/chunks/pages/blog/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/chunks/pages/blog/%5B...slug%5D-7f5f3a1ccb3e38bb.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aedd6f9fe9f2ad0e936ccdbc79871d892d55cfa7324490cb72c1ba4dbc226b2d
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"2b89-19326f6f670"
x-compute
true
age
425714
expires
Thu, 13 Nov 2025 21:15:52 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220138-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
0, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.116838,VS0,VE23
via
1.1 varnish, 1.1 varnish
cf-ray
8e21c796dd1a3626-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
3834
server
cloudflare
_buildManifest.js
www.forcepoint.com/_next/static/zl_MgWdu-4szND9Fy8JRT/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/zl_MgWdu-4szND9Fy8JRT/_buildManifest.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71f8db1e7148190718733e69a0e43e577a7b31b46c9c28b86c7bdf6221b9320a
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"da8-19326f6f67c"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-eddf8230105-FRA, cache-fra-eddf8230051-FRA
x-cache-hits
134, 0
vary
Accept-Encoding
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.116820,VS0,VE12
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127564e46dba3-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
1173
server
cloudflare
_ssgManifest.js
www.forcepoint.com/_next/static/zl_MgWdu-4szND9Fy8JRT/ 		123 B
304 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.forcepoint.com/_next/static/zl_MgWdu-4szND9Fy8JRT/_ssgManifest.js
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce9b2a0d12af8cc2a31b156699466dc8ff0539ec326ff43d65e1947eebe0a0fd
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"7b-19326f6f67c"
x-compute
true
age
432278
expires
Thu, 13 Nov 2025 19:26:29 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 13 Nov 2024 19:18:59 GMT
x-served-by
cache-fra-etou8220086-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
5c99488b9929a739e11b34c340de7fe3
vary
Accept-Encoding
x-cache-hits
117, 0
strict-transport-security
max-age=300
cache-control
public, max-age=31536000
x-timer
S1731958267.116761,VS0,VE8
via
1.1 varnish, 1.1 varnish
cf-ray
8e21275648cad34d-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
101
server
cloudflare
forcepoint.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/forcepoint.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
193e0225963098e09e3e0ffbf572ea24d8749a0b851ca46d9b227e461b56497a
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-b-6df766b9c-jc8ks
x-robots-tag
noindex
content-encoding
gzip
etag
W/"66184ee1-caf"
age
1145132
expires
Wed, 09 Jul 2025 16:51:34 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Thu, 11 Apr 2024 20:58:09 GMT
x-cache-hits
1, 1
x-served-by
cache-chi-klot8100092-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.114677,VS0,VE19
x-styx-req-id
558d770a-3d4a-11ef-bead-fe637b9f71e6
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
1392
server
nginx
f.svg
www.forcepoint.com/images/ 		230 B
613 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.forcepoint.com/images/f.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8cff92ea2968be114791608fcd1e87b324f6b3b61c9f58017aca1e9978e1407b
Security Headers
Name Value
Content-Security-Policy frame-ancestors self https://*.forcepoint.com https://*.pantheonsite.io
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"e6-19326f72eca"
x-compute
true
age
4391
expires
Wed, 13 Nov 2024 23:26:30 GMT
x-cache
HIT, MISS
date
Mon, 18 Nov 2024 19:31:07 GMT
http_x_geo_continent
EU
content-type
image/svg+xml
last-modified
Wed, 13 Nov 2024 19:19:13 GMT
x-served-by
cache-fra-eddf8230060-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
621b856204f491a58829ebf6d76f8e43
vary
Accept-Encoding
x-cache-hits
0, 0
strict-transport-security
max-age=300
content-security-policy
frame-ancestors self https://*.forcepoint.com https://*.pantheonsite.io
cache-control
public, max-age=14400
x-timer
S1731958267.040785,VS0,VE27
via
1.1 varnish, 1.1 varnish
cf-ray
8e2127611c473a5a-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
190
server
cloudflare
about_us_0_0.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/about_us_0_0.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
98bee51ffbb032cfea01030abf23549c6d762f6d8283599e52bfb089f01b8742
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-b-66879dcf5b-xsvvl
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a58e-76e"
age
394144
expires
Tue, 02 Sep 2025 11:28:06 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:41:34 GMT
x-cache-hits
0, 0
x-served-by
cache-chi-klot8100153-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.114327,VS0,VE22
x-styx-req-id
42693924-6855-11ef-b8a9-e6f9d6dad8ef
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
866
server
nginx
our_approach_0_0.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/our_approach_0_0.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3058f7c617c39b1a94849fa7223c2f756437af3f215155d37c2a29c36848e28d
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-a-6865f55c95-tfspd
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a58f-a97"
age
1145128
expires
Fri, 13 Jun 2025 13:59:20 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:41:35 GMT
x-cache-hits
1, 0
x-served-by
cache-chi-klot8100063-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.114765,VS0,VE16
x-styx-req-id
f7930f0f-28c3-11ef-8325-e2d901500dd5
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
1012
server
nginx
our_customers_0_1.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/our_customers_0_1.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c2a54667fcd4151ef9a27b18f84f24c0b884fe593302ca1eb1210d114f4bd06b
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-b-6cfd9789f5-bbwtx
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a58f-9af"
age
1145128
expires
Fri, 13 Jun 2025 13:59:20 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:41:35 GMT
x-cache-hits
1, 0
x-served-by
cache-chi-kigq8000135-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.114314,VS0,VE17
x-styx-req-id
f792ef97-28c3-11ef-9e01-661a22356727
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
913
server
nginx
fp_one_icon_12_0.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		1 KB
955 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/fp_one_icon_12_0.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-a-6865f55c95-8kd6g
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a786-5ed"
age
504812
expires
Fri, 13 Jun 2025 13:59:21 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:49:58 GMT
x-cache-hits
1, 0
x-served-by
cache-chi-klot8100166-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.114931,VS0,VE21
x-styx-req-id
f7a408a6-28c3-11ef-b151-6a8d2666d2a0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
725
server
nginx
fp_one_icon-hover_12_0.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/fp_one_icon-hover_12_0.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-a-b78c78944-bdm9c
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a786-5fb"
age
323483
expires
Mon, 11 Aug 2025 14:40:25 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:49:58 GMT
x-cache-hits
1, 0
x-served-by
cache-chi-kigq8000110-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.114442,VS0,VE14
x-styx-req-id
7ab70aa4-5726-11ef-8db4-b6f5a0a6a64a
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
737
server
nginx
fp_one_icon_0_1.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		1 KB
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/fp_one_icon_0_1.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-a-6865f55c95-bh65w
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a58e-5ed"
age
398059
expires
Fri, 13 Jun 2025 13:59:21 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:41:34 GMT
x-cache-hits
1, 0
x-served-by
cache-chi-kigq8000061-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.144950,VS0,VE10
x-styx-req-id
f7adb03a-28c3-11ef-ac5a-b6c8d4aeb1a5
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
725
server
nginx
fp_one_icon-hover_0_1.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/fp_one_icon-hover_0_1.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-b-55f6fb8478-m4rx9
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a58e-5fb"
age
1145131
expires
Wed, 16 Jul 2025 17:37:22 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:41:34 GMT
x-cache-hits
1, 0
x-served-by
cache-chi-kigq8000079-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.144739,VS0,VE9
x-styx-req-id
e4870eed-42d0-11ef-bd1a-ea18c8cca166
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
737
server
nginx
cyber_edu_icon_11.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/cyber_edu_icon_11.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
fad8df5718762444a80e745fd3b375ecfee298b37c480de5134b8a0ed05bc7a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-b-55f6fb8478-v5z7r
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a58f-9a9"
age
414022
expires
Wed, 16 Jul 2025 17:37:22 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:41:35 GMT
x-cache-hits
45, 0
x-served-by
cache-chi-klot8100115-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.144611,VS0,VE10
x-styx-req-id
e486cd3f-42d0-11ef-b88b-8aac72d2bee6
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
813
server
nginx
cyber_edu_icon-hover_11.svg
live-forcepoint-drupal.pantheonsite.io/sites/default/files/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live-forcepoint-drupal.pantheonsite.io/sites/default/files/cyber_edu_icon-hover_11.svg
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
2528d731c4e61e67f78982f202d1de7e6f7a234117b4d9c98325c27e33c6e1d3
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/

Response headers

x-pantheon-styx-hostname
styx-fe4-a-86c56f4f98-f2k85
x-robots-tag
noindex
content-encoding
gzip
etag
W/"6669a58f-b0c"
age
1145132
expires
Wed, 23 Jul 2025 13:32:10 GMT
x-cache
HIT, HIT
date
Mon, 18 Nov 2024 19:31:07 GMT
content-type
image/svg+xml
last-modified
Wed, 12 Jun 2024 13:41:35 GMT
x-cache-hits
1, 0
x-served-by
cache-chi-kigq8000159-CHI, cache-fra-eddf8230037-FRA
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1731958267.144907,VS0,VE10
x-styx-req-id
cc2b4639-482e-11ef-9db0-3a043de74cb9
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
869
server
nginx
image
www.forcepoint.com/_next/ 		112 KB
113 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.forcepoint.com/_next/image?url=https%3A%2F%2Flive-forcepoint-drupal.pantheonsite.io%2Fsites%2Fdefault%2Ffiles%2Fhero%2Fphoto-1520386950581-900a51cbbc93_0.jpeg&w=750&q=75
Requested by
Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudflare /
Resource Hash
82366ff938cfeb4a83eaa4ad06e16c671860379befaac4a557aea3ba5b7d8e52
Security Headers
Name Value
Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox;
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.forcepoint.com/blog/x-labs/using-c-post-powershell-attacks

Response headers

cf-cache-status
DYNAMIC
etag
gjZv+TjP60qD6qStBuFsZxhgN5vvqsSlV66jult9jlI=
x-compute
true
age
0
x-cache
MISS, MISS
date
Mon, 18 Nov 2024 19:31:08 GMT
http_x_geo_continent
EU
content-type
image/webp
content-disposition
inline; filename="photo-1520386950581-900a51cbbc93_0.webp"
x-served-by
cache-fra-eddf8230152-FRA, cache-fra-eddf8230051-FRA
x-cloud-trace-context
52d860481bae03a86579d203c173852c
vary
Accept, Accept-Encoding
x-cache-hits
0, 0
strict-transport-security
max-age=300
content-security-policy
script-src 'none'; frame-src 'none'; sandbox;
cache-control
public, max-age=31622400, must-revalidate
x-timer
S1731958267.141696,VS0,VE984
via
1.1 varnish, 1.1 varnish
cf-ray
8e4a6101c82f3623-FRA
accept-ranges
bytes
http_x_geo_region
DE-HE
content-length
115084
x-nextjs-cache
MISS
server
cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdn.neverbounce.com
URL
https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Verdicts & Comments Add Verdict or Comment

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _NBSettings number| _vis_opt_account_id string| _vis_opt_protocol string| _vis_opt_script1src string| _vis_opt_script1id string| _vis_opt_script2src string| _vis_opt_script2id function| _vis_opt_loadScript function| _vis_opt_loadScript_write function| loadTopBottomScript function| vwoSyncCode function| consentCookie function| vwoConsentGiven function| shouldRunScript object| body function| insertModalInBody function| userScrolledUp function| userInteracted function| userSpentTime function| userLeavesPage function| closeModal object| forresterUrls object| dseUrls object| baseUap function| createUapModal object| validTypes function| handleLoadUap function| assureLoading function| navigationDetection function| _typeof function| _regeneratorRuntime function| asyncGeneratorStep function| _asyncToGenerator string| hard_cust_id

2 Cookies

Domain/Path Name / Value
www.forcepoint.com/ Name: userCountryCode
Value: DE
www.forcepoint.com/ Name: userCountry
Value: Germany

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors self https://*.forcepoint.com https://*.pantheonsite.io
Strict-Transport-Security max-age=300

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.neverbounce.com
live-forcepoint-drupal.pantheonsite.io
tags.tiqcdn.com
www.forcepoint.com
cdn.neverbounce.com
2600:9000:235a:2800:7:2bfb:7c00:93a1
2620:12a:8001::4
2a04:4e42:600::740
08a1ba5b234dfdfd29f77c3a9250ae57d0cded23f6f3abdb2c90f018a1d28e70
0f773f254ebb4056825f24e4b590e44364293d423b75f53b3015964bf5d2ceed
13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b
1416beb9d1c5f4217052c2c88fe77efded9407a22e12760baba651ea859caedb
193e0225963098e09e3e0ffbf572ea24d8749a0b851ca46d9b227e461b56497a
1f071a798b7ade7ea830012150e599450b358a284559d225f5c2b9408a602726
2528d731c4e61e67f78982f202d1de7e6f7a234117b4d9c98325c27e33c6e1d3
2cee1ea050594fbc4286dab81a1e54e7e257af74c362dd5000a07f6b2d516191
3058f7c617c39b1a94849fa7223c2f756437af3f215155d37c2a29c36848e28d
42793f24dc3fddca04cc84a6991f0fc73c25498d023b07d488dd5e4238ed9b0c
52239b576d3fdb13fa5cec121a5e5ed123560a4ac1310d991f4694bcc5507710
5390daebe4fc263953ae2cd18f060ebb4aaef20d9df443a4d784cc642ed1eaf2
6b3f346d149f1975ee2de68d155ad4131de2b22c62b9e7d9b2e5481349839b29
71f8db1e7148190718733e69a0e43e577a7b31b46c9c28b86c7bdf6221b9320a
74dde3ed216ca00112ca8bb243f0acdd5f92521ab3f86a93661f7cfa5ba8f124
7a027c8cebff369b835d8d92ccdc126d12d4225c7db9e8debf238833c56b7ca2
7bc82d52b9d6b5642f653a3abced989d08bfc77e4a4f2bf14185a6853071cabb
802d9342a8ee1b31e4f3ffeb1301d83fa469e4b5bc94d76f6e556f318ce8b702
82366ff938cfeb4a83eaa4ad06e16c671860379befaac4a557aea3ba5b7d8e52
8709e66f3192aac47989a4f2c826afc3062b52de3cd792115cba3314c05656c6
8cff92ea2968be114791608fcd1e87b324f6b3b61c9f58017aca1e9978e1407b
90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158
98bee51ffbb032cfea01030abf23549c6d762f6d8283599e52bfb089f01b8742
a922d06946c153c130de6238a7d90e238f1341d19d42cee935017ad7495589e5
aedd6f9fe9f2ad0e936ccdbc79871d892d55cfa7324490cb72c1ba4dbc226b2d
b23bed5014767cbb946a2555da6ad0a18ea89ac71e7abd9a05402abdbbfba9cc
b7082c98641f82287ee830bdef5ee7c447c042d01f42b0b0bdadd1b819fb0c93
c1524c7035a894f370d34f2d57704873a3978adef91d97978e3598515762eace
c2a54667fcd4151ef9a27b18f84f24c0b884fe593302ca1eb1210d114f4bd06b
c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0
ce9b2a0d12af8cc2a31b156699466dc8ff0539ec326ff43d65e1947eebe0a0fd
d88c03f60c9b0c3b3a4a929ad268b6078dda88e59ea5c98eeb16f031ffb0d9e0
fad8df5718762444a80e745fd3b375ecfee298b37c480de5134b8a0ed05bc7a5