www.forcepoint.com Open in urlscan Pro
2a04:4e42:600::740 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Submission: On July 18 via api (July 18th 2024, 8:21:56 am UTC) from DE — Scanned from DE

Summary HTTP 120 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 14 IPs in 5 countries across 13 domains to perform 120 HTTP transactions. The main IP is 2a04:4e42:600::740, located in United States and belongs to FASTLY, US. The main domain is www.forcepoint.com. The Cisco Umbrella rank of the primary domain is 535186.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on November 22nd 2023. Valid for: a year.

This is the only time www.forcepoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
100	2a04:4e42:600... 2a04:4e42:600::740	54113 (FASTLY) (FASTLY)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
4	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:235... 2600:9000:235a:3400:7:2bfb:7c00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.18.141.119 104.18.141.119	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	103.43.90.117 103.43.90.117	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:206... 2600:9000:206f:fe00:5:7a81:86c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.80.204 104.18.80.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	159.89.102.253 159.89.102.253	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2602:816:5001... 2602:816:5001::39	54113 (FASTLY) (FASTLY)
1	2400:52e0:1e0... 2400:52e0:1e00::1079:1	60068 (CDN77 _) (CDN77 _)
1	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
1	185.182.193.176 185.182.193.176	49981 (WORLDSTREAM) (WORLDSTREAM)
120	14

100 2a04:4e42:600::740 (United States)

ASN54113 (FASTLY, US)

www.forcepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:235a:3400:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.141.119 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.43.90.117 (Singapore, Singapore) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:fe00:5:7a81:86c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.80.204 (None, )

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 159.89.102.253 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

geolocation-db.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:816:5001::39 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2400:52e0:1e00::1079:1 (Germany)

ASN60068 (CDN77 _, GB)

scripts.simpleanalyticscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.241.14 (Portland, United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.182.193.176 (Naaldwijk, Netherlands)

ASN49981 (WORLDSTREAM, NL)
PTR: 185-182-193-176.hosted-by-worldstream.net

queue.simpleanalyticscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
100	forcepoint.com www.forcepoint.com — Cisco Umbrella Rank: 535186	2 MB
4	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 9382 forms-na1.hsforms.com — Cisco Umbrella Rank: 15115	16 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	68 KB
3	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1751	117 KB
2	simpleanalyticscdn.com scripts.simpleanalyticscdn.com — Cisco Umbrella Rank: 119088 queue.simpleanalyticscdn.com — Cisco Umbrella Rank: 86702	5 KB
2	geolocation-db.com geolocation-db.com — Cisco Umbrella Rank: 34979	513 B
2	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 764	2 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 441	701 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 1453	16 KB
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 48041	279 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 42102	283 B
1	hsforms.net js.hsforms.net — Cisco Umbrella Rank: 14516	156 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1211	33 KB
120	13

	Domain	Requested by
100	www.forcepoint.com	www.forcepoint.com
4	cdnjs.cloudflare.com	www.forcepoint.com
3	tags.tiqcdn.com	www.forcepoint.com tags.tiqcdn.com
2	geolocation-db.com	code.jquery.com
2	forms-na1.hsforms.com	www.forcepoint.com
2	forms.hsforms.com	js.hsforms.net
2	secure.adnxs.com	2 redirects
1	queue.simpleanalyticscdn.com
1	bam.nr-data.net	js-agent.newrelic.com
1	scripts.simpleanalyticscdn.com	www.forcepoint.com
1	js-agent.newrelic.com	www.forcepoint.com
1	attr.ml-api.io	www.forcepoint.com
1	s.ml-attr.com	1 redirects
1	js.hsforms.net	www.forcepoint.com
1	code.jquery.com	www.forcepoint.com
120	15

This site contains links to these domains. Also see Links.

Domain
partners.forcepoint.com
support.forcepoint.com
learn.forcepoint.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
forcepoint.com Sectigo RSA Organization Validation Secure Server CA	`2023-11-22` - `2024-11-21`	a year	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M02	`2024-03-19` - `2025-04-17`	a year	crt.sh
hsforms.net WE1	`2024-06-13` - `2024-09-11`	3 months	crt.sh
hsforms.com WE1	`2024-06-14` - `2024-09-12`	3 months	crt.sh
geolocation-db.com R11	`2024-06-10` - `2024-09-08`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-21` - `2025-04-22`	a year	crt.sh
scripts.simpleanalyticscdn.com R10	`2024-07-03` - `2024-10-01`	3 months	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh
queue.simpleanalyticscdn.com R10	`2024-06-12` - `2024-09-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Frame ID: 0BBAEE4D035E582259373942EDADD0FF
Requests: 141 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ShadowRoot Ransomware Targeting Turkish Businesses

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

120
Requests

99 %
HTTPS

40 %
IPv6

13
Domains

15
Subdomains

14
IPs

5
Countries

2593 kB
Transfer

6027 kB
Size

12
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://partners.forcepoint.com/s/login/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://support.forcepoint.com/s/
Title: Support Login

Search URL Search Domain Scan URL

URL: https://learn.forcepoint.com/
Title: Training

Search URL Search Domain Scan URL

URL: https://learn.forcepoint.com/catalog?query=e-learning
Title: Free E-Learning Courses

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/forcepoint?trk=fc_badge
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/forcepointsec
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ForcepointLLC
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC4MbQECdktvwewRlAFwT_-w
Title: YouTube

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 98

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.forcepoint.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=www.forcepoint.com&pId=7334164860651945289

120 HTTP transactions
21 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request shadowroot-ransomware-targeting-turkish-businesses Show response
www.forcepoint.com/blog/x-labs/ 126 KB
44 KB 159ms
58ms Document
text/html 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

483feab2b57e186b9b87d17c0441d26fd342526af75d64c8985a85734b879eb3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .fonts.net .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com .ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com .nr-data.net .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com .theadex.com .aumago.com .driftqa.com .scribblecdn.net .esg-global.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .clickagy.com .nimblestory.com .usemessages.com .stackadapt.com .googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com; img-src * data: ; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com .hubspot.com .hubspot.net .demdex.net .libsyn.com .youtube.com; font-src 'self' .google.com .googleadservices.com; connect-src 'self' .vwo.com .demdex.net .omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net .theadex.com .aumago.com .google-analytics.com .6sc.co .adnxs.com .vidyard.com .6sense.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com api.hubapi.com .hsforms.net .hsforms.com .s3.amazonaws.com .drift.com .clickagy.com .facebook.com .zoominfo.com geolocation-db.com dn.linkedin.oribi.io .hubspot.com .hscollectedforms.net .stackadapt.com .google.com .googletagmanager.com .googleadservices.com google.com .googlesyndication.com .linkedin.com .redditstatic.com .reddit.com .g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 691
cache-control: public, max-age=3600
content-encoding: gzip
content-language: en
content-length: 38017
content-security-policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jul 2024 08:21:50 GMT
etag: W/"1721290218-0"
expires: Sun, 19 Nov 1978 05:00:00 GMT
from-origin: same, https://analyticsssl.forcepoint.com,https://vidyard.com
http_x_geo_continent: EU
http_x_geo_region: DE-BY
last-modified: Thu, 18 Jul 2024 08:10:18 GMT
link: </sites/all/themes/custom/fp/assets/fonts/hoves-optimized//Hoves_DemiBold.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_DemiBold.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Medium.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Regular.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Italic.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light_Italic.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_ExtraLight.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</misc/throbber-inactive.png>; rel=preload; as=image; type="image/png"; nopush,</misc/throbber-active.gif>; rel=preload; as=image; type="image/gif"; nopush,</misc/grippie.png>; rel=preload; as=image; type="image/png"; nopush,</misc/draggable.png>; rel=preload; as=image; type="image/png"; nopush,</misc/tree.png>; rel=preload; as=image; type="image/png"; nopush,</misc/tree-bottom.png>; rel=preload; as=image; type="image/png"; nopush,</misc/message-24-ok.png>; rel=preload; as=image; type="image/png"; nopush,</misc/message-24-warning.png>; rel=preload; as=image; type="image/png"; nopush,</misc/message-24-error.png>; rel=preload; as=image; type="image/png"; nopush,</misc/help.png>; rel=preload; as=image; type="image/png"; nopush,</misc/menu-expanded.png>; rel=preload; as=image; type="image/png"; nopush,</misc/menu-collapsed.png>; rel=preload; as=image; type="image/png"; nopush,</misc/progress.gif>; rel=preload; as=image; type="image/gif"; nopush,</sites/all/libraries/chosen/chosen-sprite.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/libraries/chosen/chosen-sprite@2x.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_flat_75_ffffff_40x100.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_highlight-soft_75_cccccc_1x100.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_e6e6e6_1x400.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_dadada_1x400.png>; rel=preload; as=image; type="image/png"; nopush
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=18410000; includeSubDomains; preload
vary: Accept-Encoding, x-geo-country, Cookie, Cookie
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT, MISS
x-cache-hits: 2, 11, 0
x-content-type-options: nosniff
x-drupal-cache: MISS
x-frame-options: SAMEORIGIN
x-generator: Drupal 7 (http://drupal.org)
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-gk745
x-served-by: cache-chi-kigq8000156-CHI, cache-mxp6920-MXP, cache-mxp6972-MXP
x-styx-req-id: 2ba30fa4-44dd-11ef-baca-4e257a6666f1
x-timer: S1721290911.683188,VS0,VE6
x-ua-compatible: IE=Edge,chrome=1
x-xss-protection: 1

GET
H2 200 Hoves_DemiBold.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized// 18 KB
19 KB 53ms
52ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized//Hoves_DemiBold.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-zjqjf
content-length: 18868
x-served-by: cache-chi-kigq8000062-CHI, cache-mxp6982-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:36:00 GMT
server: nginx
x-timer: S1721290911.746908,VS0,VE5
etag: "66958830-49b4"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16ff3869-4345-11ef-a32f-9265e67163a1
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 28, 17, 0

GET
H2 200 Hoves_DemiBold.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/ 18 KB
19 KB 103ms
102ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_DemiBold.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-zjqjf
content-length: 18868
x-served-by: cache-chi-kigq8000080-CHI, cache-mxp6967-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:35:59 GMT
server: nginx
x-timer: S1721290911.747753,VS0,VE5
etag: "6695882f-49b4"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16ff3adc-4345-11ef-a32f-9265e67163a1
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 29, 105, 0

GET
H2 200 Hoves_Medium.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/ 18 KB
18 KB 82ms
81ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Medium.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c1524c7035a894f370d34f2d57704873a3978adef91d97978e3598515762eace

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-nf2vw
content-length: 18688
x-served-by: cache-chi-klot8100097-CHI, cache-mxp6961-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:35:59 GMT
server: nginx
x-timer: S1721290911.747720,VS0,VE5
etag: "6695882f-4900"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16fead65-4345-11ef-b54a-f60fc8a2deb7
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 29, 18, 0

GET
H2 200 Hoves_Regular.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/ 18 KB
18 KB 58ms
57ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Regular.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

42793f24dc3fddca04cc84a6991f0fc73c25498d023b07d488dd5e4238ed9b0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-jgk2s
content-length: 18436
x-served-by: cache-chi-klot8100104-CHI, cache-mxp6955-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:36:00 GMT
server: nginx
x-timer: S1721290911.747716,VS0,VE4
etag: "66958830-4804"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16ff6e58-4345-11ef-8edb-c281824f74e2
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 29, 104, 0

GET
H2 200 Hoves_Italic.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/ 19 KB
20 KB 64ms
63ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Italic.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

8709e66f3192aac47989a4f2c826afc3062b52de3cd792115cba3314c05656c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-7qhbq
content-length: 19656
x-served-by: cache-chi-klot8100074-CHI, cache-mxp6979-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:35:59 GMT
server: nginx
x-timer: S1721290911.747685,VS0,VE5
etag: "6695882f-4cc8"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16fecca0-4345-11ef-a73a-5adf03037691
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 29, 104, 0

GET
H2 200 Hoves_Light.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/ 18 KB
18 KB 109ms
109ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5390daebe4fc263953ae2cd18f060ebb4aaef20d9df443a4d784cc642ed1eaf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-x5pqn
content-length: 18600
x-served-by: cache-chi-kigq8000086-CHI, cache-mxp6945-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:35:59 GMT
server: nginx
x-timer: S1721290911.747646,VS0,VE6
etag: "6695882f-48a8"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16ffed9d-4345-11ef-9849-f21714ecd673
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 103, 0

GET
H2 200 Hoves_Light_Italic.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/ 19 KB
19 KB 102ms
101ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light_Italic.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d88c03f60c9b0c3b3a4a929ad268b6078dda88e59ea5c98eeb16f031ffb0d9e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-ghkb8
content-length: 19360
x-served-by: cache-chi-klot8100179-CHI, cache-mxp6956-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:35:59 GMT
server: nginx
x-timer: S1721290911.747626,VS0,VE5
etag: "6695882f-4ba0"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16ff45c9-4345-11ef-a39f-4ace80ec767d
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 29, 105, 0

GET
H2 200 Hoves_ExtraLight.woff
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/ 18 KB
18 KB 109ms
108ms Font
font/woff 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_ExtraLight.woff

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

52239b576d3fdb13fa5cec121a5e5ed123560a4ac1310d991f4694bcc5507710

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 17 Jul 2025 07:29:08 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-czhxs
content-length: 17944
x-served-by: cache-chi-kigq8000066-CHI, cache-mxp6976-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:35:59 GMT
server: nginx
x-timer: S1721290911.747960,VS0,VE5
etag: "6695882f-4618"
content-type: font/woff
access-control-allow-origin: *
x-styx-req-id: 16ff4e24-4345-11ef-84ac-ba0dcdbb94b4
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 29, 104, 0

GET
H2 200 throbber-inactive.png
www.forcepoint.com/misc/ 140 B
493 B 66ms
59ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/throbber-inactive.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b48a895c0170a7310b29b01897fcf1954b43655748ce98037abae38562754a29

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 453, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240195
age: 2017341
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=320 idim=15x13 ifmt=png ofsz=140 odim=15x13 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-59b5bdfd9-hr6dk
content-length: 140
x-served-by: cache-chi-kigq8000107-CHI, cache-ams2100108-AMS, cache-ams2100108-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.971561,VS0,VE2
etag: "CYYfXWQxa+SPObSsE32Xk7Do+LMPmm8BZYCZJK1ZEUA"
vary: Accept
content-type: image/webp
x-styx-req-id: 49ffb039-25f3-11ef-bcb1-92bc69777a0d
cache-control: max-age=31622400
accept-ranges: bytes
expires: Tue, 10 Jun 2025 00:00:32 GMT

GET
H2 200 throbber-active.gif
www.forcepoint.com/misc/ 1 KB
2 KB 64ms
57ms Image
image/gif 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/throbber-active.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4d58ffb4437135b1a4f7b8cbf01321ea85fe244416aed493ea942462f3d58c86

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 1884, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240196
age: 2611365
http_x_geo_region: DE-BY
x-cache: MISS, HIT, HIT, HIT
fastly-io-info: ifsz=1233 idim=15x13 ifmt=gif ofsz=1233 odim=15x13 ofmt=gif ofrm=12
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-6f444b4778-vqrq7
content-length: 1233
fastly-io-warning: Failed to shrink image
x-served-by: cache-chi-klot8100061-CHI, cache-ams2100089-AMS, cache-ams2100095-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.971570,VS0,VE2
etag: "cciM0uPCYoc09vCSqOmHV4nMniFUM15FCTn0mYxlwCQ"
vary: Accept
content-type: image/gif
x-styx-req-id: 0a09d030-23ae-11ef-9e02-ea1b49524294
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 07 Jun 2025 02:39:47 GMT

GET
H2 200 grippie.png
www.forcepoint.com/misc/ 56 B
387 B 60ms
52ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/grippie.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f7d4d17ef4f0103008287290e9dd7bb35be1d08f0f8bc315033d13d0cfa6a6a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 114, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: img05-europe-west3
age: 2034246
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=106 idim=27x5 ifmt=png ofsz=56 odim=27x5 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-rszwb
content-length: 56
x-served-by: cache-chi-klot8100115-CHI, cache-ams2100099-AMS, cache-ams2100099-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972408,VS0,VE1
etag: "kt9RZLYHWjv58VxK34gY2gtJI3NheIs+DTYX4JV5AGA"
vary: Accept
content-type: image/webp
x-styx-req-id: 6f798f72-325e-11ef-8528-d260c23d87a7
cache-control: max-age=31622400
accept-ranges: bytes
expires: Wed, 25 Jun 2025 19:17:45 GMT

GET
H2 200 draggable.png
www.forcepoint.com/misc/ 268 B
670 B 67ms
59ms Image
image/png 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/draggable.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

10aa7853a3babe185246e6f1fad2c5800902a268dd63b66c53b96889ee5188f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 1785, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240193
age: 3037872
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=268 idim=15x60 ifmt=png ofsz=268 odim=15x60 ofmt=png
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-845bccb87b-rxdp4
content-length: 268
fastly-io-warning: Failed to shrink image
x-served-by: cache-chi-kigq8000056-CHI, cache-ams21022-AMS, cache-ams21022-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972321,VS0,VE2
etag: "KWIpRFdw6XY1xKLUIvevvjFCVB7MVHDdktcCcAkddP0"
vary: Accept
content-type: image/png
x-styx-req-id: af6b1826-293d-11ef-98e5-5a38d201be85
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 14 Jun 2025 04:30:38 GMT

GET
H2 200 tree.png
www.forcepoint.com/misc/ 82 B
442 B 63ms
56ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/tree.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

69a02b48768b8f413fe8470c65b4232a39dc3d68350f1246da8721e92ac7e75d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 1173, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240193
age: 5042098
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=130 idim=80x81 ifmt=png ofsz=82 odim=80x81 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-7d5d4db597-dqfkt
content-length: 82
x-served-by: cache-chi-kigq8000035-CHI, cache-ams21043-AMS, cache-ams21043-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972306,VS0,VE1
etag: "Z35FTfoaAVemLhiXshryO4rkEzH1KA6bO8GIRsSVaO0"
vary: Accept
content-type: image/webp
x-styx-req-id: 3bc0241e-1703-11ef-911d-fa2fe945313b
cache-control: max-age=31622400
accept-ranges: bytes
expires: Wed, 21 May 2025 23:46:52 GMT

GET
H2 200 tree-bottom.png
www.forcepoint.com/misc/ 78 B
438 B 58ms
51ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/tree-bottom.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

bfcc07136dc1faaee36973ca4858e530e403f2f41948fbdc47f0c3c399308db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 3, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240193
age: 1933391
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=129 idim=80x81 ifmt=png ofsz=78 odim=80x81 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-845bccb87b-p2227
content-length: 78
x-served-by: cache-chi-klot8100109-CHI, cache-ams21028-AMS, cache-ams2100120-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972282,VS0,VE2
etag: "JyOt5s8au+dKwuKYWT9ybz2cVW6ZbelcJx3DlTABXvE"
vary: Accept
content-type: image/webp
x-styx-req-id: 7af64f9a-25d9-11ef-aaa0-32e1e988a97f
cache-control: max-age=31622400
accept-ranges: bytes
expires: Mon, 09 Jun 2025 20:55:47 GMT

GET
H2 200 message-24-ok.png
www.forcepoint.com/misc/ 902 B
1 KB 65ms
58ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/message-24-ok.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4c8537e1208918b04f3b7970b4e53d6c91b138b7b8325b469a4a5e84ced6ce2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 966, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240195
age: 1215813
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=1058 idim=24x24 ifmt=png ofsz=902 odim=24x24 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-59b5bdfd9-jkpwr
content-length: 902
x-served-by: cache-chi-klot8100043-CHI, cache-ams2100101-AMS, cache-ams2100101-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972218,VS0,VE1
etag: "60PoYDt+1vFXU4yAkaVKB1clxMNlUR3MuNzEGSZ9U9Y"
vary: Accept
content-type: image/webp
x-styx-req-id: 6c2a77d3-252c-11ef-9069-0ee4d9524d06
cache-control: max-age=31622400
accept-ranges: bytes
expires: Mon, 09 Jun 2025 00:16:59 GMT

GET
H2 200 message-24-warning.png
www.forcepoint.com/misc/ 612 B
1 KB 58ms
52ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/message-24-warning.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

bd74c29617fed2dbd2f684dce7eebb659567ce0ae06be3418615ebe846a1bf5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 900, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240195
age: 3504826
http_x_geo_region: DE-BY
x-cache: HIT, HIT, HIT, HIT
fastly-io-info: ifsz=753 idim=24x24 ifmt=png ofsz=612 odim=24x24 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-59b5bdfd9-bfq9m
content-length: 612
x-served-by: cache-chi-klot8100163-CHI, cache-ams2100116-AMS, cache-ams2100125-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972190,VS0,VE2
etag: "etN9kWF1zriHIse4xor9Tv/e40PLoR3lRGg8xe6tRQE"
vary: Accept
content-type: image/webp
x-styx-req-id: 79692076-24fe-11ef-8faa-8658b3269531
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 08 Jun 2025 18:48:04 GMT

GET
H2 200 message-24-error.png
www.forcepoint.com/misc/ 614 B
988 B 64ms
57ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/message-24-error.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

496d9a19dda325d9587f3729b5a16b1262f91a6b237e1aa5d54ed90e087c35e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 526, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: img03-europe-west3
age: 1381616
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=733 idim=24x24 ifmt=png ofsz=614 odim=24x24 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-777f57d6b4-nr2qv
content-length: 614
x-served-by: cache-chi-kigq8000043-CHI, cache-ams21042-AMS, cache-ams2100097-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972106,VS0,VE1
etag: "gVoMZ8dd1QgL/2SjIwn0GwzJENiBt143AYaoiF4Ws6M"
vary: Accept
content-type: image/webp
x-styx-req-id: 6d90d03b-1eb1-11ef-92d1-b65dd15c85b7
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 31 May 2025 18:21:26 GMT

GET
H2 200 help.png
www.forcepoint.com/misc/ 192 B
671 B 62ms
55ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/help.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f8c79df7183de5a0687fc40c5a9b1034d074e603d558c05a5311c7f91d9ccfe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 748, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240192
age: 2936584
http_x_geo_region: DE-BY
x-cache: MISS, HIT, HIT, HIT
fastly-io-info: ifsz=294 idim=16x16 ifmt=png ofsz=192 odim=16x16 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-59b5bdfd9-spddv
content-length: 192
x-served-by: cache-chi-klot8100132-CHI, cache-ams2100142-AMS, cache-ams2100142-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.972074,VS0,VE2
etag: "v6al66PXjd/2WqSfHyL2pCCxkfKAcJfvgCU3I6pbO+4"
vary: Accept
content-type: image/webp
x-styx-req-id: 4ec7cb3f-2600-11ef-846b-76eb4d548b88
cache-control: max-age=31622400
accept-ranges: bytes
expires: Tue, 10 Jun 2025 01:33:43 GMT

GET
H2 200 menu-expanded.png
www.forcepoint.com/misc/ 46 B
505 B 72ms
65ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/menu-expanded.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5cfc739598cda856cc20575229f8a5251e8df5b175830fe7886aaef79dfb6886

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 81, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240192
age: 776572
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=106 idim=7x7 ifmt=png ofsz=46 odim=7x7 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-p5mqc
content-length: 46
x-served-by: cache-chi-klot8100163-CHI, cache-ams2100118-AMS, cache-ams2100118-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.974759,VS0,VE2
etag: "lnOeF6KlRRR5aM+MCm3C8DB9Vu1cySrSTIEOJY+eTS4"
vary: Accept
content-type: image/webp
x-styx-req-id: 5853b917-34bc-11ef-ac9d-ee9e1dde6fad
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 28 Jun 2025 19:35:01 GMT

GET
H2 200 menu-collapsed.png
www.forcepoint.com/misc/ 46 B
528 B 67ms
60ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/menu-collapsed.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

521bfd25b076ada01d23b9d20bca3a3e67840702ca4d43b73d0a496575107e9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 1, 0, 798, 30
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: img03-europe-west3
age: 4415123
http_x_geo_region: DE-BY
x-cache: HIT, HIT, HIT, HIT
fastly-io-info: ifsz=105 idim=7x7 ifmt=png ofsz=46 odim=7x7 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-777f57d6b4-2qqrj
content-length: 46
x-served-by: cache-chi-kigq8000091-CHI, cache-ams21028-AMS, cache-ams21028-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.974312,VS0,VE1
etag: "HJgRuOhWhAFgOazVOW2HjRFb16cHmG+HSX+vLor86a0"
vary: Accept
content-type: image/webp
x-styx-req-id: 065eca13-1cb7-11ef-8ba0-fa0bf1f3cf12
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 29 May 2025 05:56:28 GMT

GET
H2 200 progress.gif
www.forcepoint.com/misc/ 6 KB
6 KB 70ms
64ms Image
image/gif 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/misc/progress.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

91997f03543fdd296c85e60feede1e3df0e950aca03698583ff2870869a2dc0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 1201, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240194
age: 2871938
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=5872 idim=20x40 ifmt=gif ofsz=5872 odim=20x40 ofmt=gif ofrm=20
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-845bccb87b-srflh
content-length: 5872
fastly-io-warning: Failed to shrink image
x-served-by: cache-chi-klot8100021-CHI, cache-ams2100134-AMS, cache-ams2100134-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.974723,VS0,VE1
etag: "KSQIcjJuPSqTVV6Yjqa330VSb5j46NEcKLjR3ejGL1A"
vary: Accept
content-type: image/gif
x-styx-req-id: 883e9816-24d4-11ef-a75e-a2ab8c7907d3
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 08 Jun 2025 13:47:50 GMT

GET
H2 200 chosen-sprite.png
www.forcepoint.com/sites/all/libraries/chosen/ 430 B
876 B 69ms
63ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/libraries/chosen/chosen-sprite.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9cc77ec166565cf138f088e29b263d7de28ebff89c6ac6ac7b3226b8c2c45f33

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 2, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240195
age: 1998794
http_x_geo_region: DE-BY
x-cache: HIT, HIT, HIT, HIT
fastly-io-info: ifsz=538 idim=52x37 ifmt=png ofsz=430 odim=52x37 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-69d957dcb5-vfj67
content-length: 430
x-served-by: cache-chi-klot8100058-CHI, cache-ams21024-AMS, cache-ams2100140-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.974651,VS0,VE1
etag: "pCuJ3WEDsPQPzkbIkY90U4TfuAo3yBgHEEN2IOPELGY"
vary: Accept
content-type: image/webp
x-styx-req-id: eade0401-22ce-11ef-bdfd-06c82f407e68
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 06 Jun 2025 00:02:37 GMT

GET
H2 200 chosen-sprite@2x.png
www.forcepoint.com/sites/all/libraries/chosen/ 628 B
982 B 69ms
62ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/libraries/chosen/chosen-sprite@2x.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5f4e0577cb49e1130ec7098698e3556c0a2b7f33d02ec5789ee09b116e403f7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 1947, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240195
age: 3470807
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=738 idim=104x74 ifmt=png ofsz=628 odim=104x74 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-845bccb87b-sj8m2
content-length: 628
x-served-by: cache-chi-klot8100088-CHI, cache-ams2100105-AMS, cache-ams2100105-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.974484,VS0,VE2
etag: "1954vZ3omyWtqZWjx3EPpQPU3ZMgJvFFfwvKeF5rhm0"
vary: Accept
content-type: image/webp
x-styx-req-id: aeb22e9c-254d-11ef-9018-c6b4fe859977
cache-control: max-age=31622400
accept-ranges: bytes
expires: Mon, 09 Jun 2025 04:15:04 GMT

GET
H2 200 ui-bg_flat_75_ffffff_40x100.png
www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ 44 B
553 B 77ms
70ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_flat_75_ffffff_40x100.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

db7de84263a6dfe6f7a674f478b4a6c5a97d7de7e0c7f52a12a5dedfb201004f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 588, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240193
age: 1410881
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=178 idim=40x100 ifmt=png ofsz=44 odim=40x100 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-h68wv
content-length: 44
x-served-by: cache-chi-kigq8000066-CHI, cache-ams21029-AMS, cache-ams21029-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.973972,VS0,VE15
etag: "O9SdHkbja5Mmzi4DWOWJdZgUQirITGa5uuAK5R/QoyM"
vary: Accept
content-type: image/webp
x-styx-req-id: d182c4b2-3809-11ef-bacb-5e8344290807
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 03 Jul 2025 00:27:09 GMT

GET
H2 200 ui-bg_highlight-soft_75_cccccc_1x100.png
www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ 54 B
399 B 61ms
54ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_highlight-soft_75_cccccc_1x100.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b4229c88ccc9ec00268d759c808bb5fc56a62479618d140eebd7948299a1544b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 801, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240193
age: 2623554
http_x_geo_region: DE-BY
x-cache: HIT, HIT, HIT, HIT
fastly-io-info: ifsz=101 idim=1x100 ifmt=png ofsz=54 odim=1x100 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-59b5bdfd9-spddv
content-length: 54
x-served-by: cache-chi-kigq8000036-CHI, cache-ams2100127-AMS, cache-ams2100127-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.973928,VS0,VE2
etag: "SVL3LfYtpcUTzNEo8mHT+EoBDkNcvK2l7xiLlLE7P6w"
vary: Accept
content-type: image/webp
x-styx-req-id: 7968b358-24fe-11ef-846b-76eb4d548b88
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 08 Jun 2025 18:48:04 GMT

GET
H2 200 ui-bg_glass_75_e6e6e6_1x400.png
www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ 78 B
564 B 60ms
54ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_e6e6e6_1x400.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e68e4b1057684aa14f6d44055bd77c6ee8170be28010b94e0278e2d05775973c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 1143, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240193
age: 2506444
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=110 idim=1x400 ifmt=png ofsz=78 odim=1x400 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-55987d54bd-jlljf
content-length: 78
x-served-by: cache-chi-kigq8000098-CHI, cache-ams2100107-AMS, cache-ams2100107-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.973902,VS0,VE1
etag: "4s1MwOZKDfGEu/a/SFo57USn639l3MbW8dYbzZPyEag"
vary: Accept
content-type: image/webp
x-styx-req-id: f46b22cf-2da6-11ef-adfe-b69ccf9e7a36
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 19 Jun 2025 19:14:16 GMT

GET
H2 200 ui-bg_glass_75_dadada_1x400.png
www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ 84 B
445 B 67ms
61ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_dadada_1x400.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c16c2e899bbe232a64c1bd49e4312a7f9ea738cb2cb17058e63477a71b246fa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 132, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:50 GMT
fastly-io-served-by: vpop-etou8240195
age: 1390146
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=111 idim=1x400 ifmt=png ofsz=84 odim=1x400 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-4l4rv
content-length: 84
x-served-by: cache-chi-klot8100024-CHI, cache-ams21038-AMS, cache-ams21038-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.973887,VS0,VE1
etag: "msf+sm6St45S//5aPCnGaIqq4DmKLsS3uxv+ikcGyuY"
vary: Accept
content-type: image/webp
x-styx-req-id: 1941820b-383a-11ef-956c-a28498a186e3
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 03 Jul 2025 06:12:45 GMT

GET
H2 200 css__YZMmyCjxADNsxWJVyzxskiYBiPsGboww8DDJoAv1iVA__PqGVjSeXe3e-YM4xspxCavDlyydtEB28TRpZPTEwV5I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 6 KB
2 KB 98ms
96ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__YZMmyCjxADNsxWJVyzxskiYBiPsGboww8DDJoAv1iVA__PqGVjSeXe3e-YM4xspxCavDlyydtEB28TRpZPTEwV5I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

942ba1b657ab7477bc603f7852ff551aa393de40d1bab2dee01c8ad36d538a2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 17, 17, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-vp8bw
content-length: 2109
x-served-by: cache-chi-kigq8000159-CHI, cache-mxp6942-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Tue, 05 Mar 2024 06:05:49 GMT
server: nginx
x-timer: S1721290911.764467,VS0,VE5
etag: W/"65e6b63d-1797"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: e591bfd4-f1d7-11ee-835d-6255bad32892
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:26 GMT

GET
H2 200 css__qi8YWDPFPT47Hua3Uo8V-CwYV79O8gYOw4xRshlFw2o__U0zx4V0QLKPamBJbsVKK0D54d038-KcpyqeXppQL9AI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 11 KB
3 KB 99ms
97ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__qi8YWDPFPT47Hua3Uo8V-CwYV79O8gYOw4xRshlFw2o__U0zx4V0QLKPamBJbsVKK0D54d038-KcpyqeXppQL9AI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

74d6ee660ac8d18d3940eefac6e8c0ff029ecc0f4a4799ada5d6088fe9abfbc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Mon, 28 Apr 2025 10:38:01 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-6zx56
content-length: 2662
x-served-by: cache-chi-kigq8000165-CHI, cache-mxp6976-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:43 GMT
server: nginx
x-timer: S1721290911.778821,VS0,VE5
etag: W/"65e6b637-2d9a"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: 387529c2-0482-11ef-be95-3a8be9a6877a
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 17, 0

GET
H2 200 css__umS_7iB8OLqD-AIc28jz7stMtgRnPBrMHXbg802aJVI__42_FYiRnR5OQaV2U3Sr9cY21EIjnMGdJsPXMEFLQPCo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 789 B
754 B 107ms
105ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__umS_7iB8OLqD-AIc28jz7stMtgRnPBrMHXbg802aJVI__42_FYiRnR5OQaV2U3Sr9cY21EIjnMGdJsPXMEFLQPCo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

76fea4cad87ffbee4d6c0d29a46382913e4a8c56ed7881d8556f684a174d6824

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Wed, 25 Jun 2025 19:24:10 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-w9nrv
content-length: 405
x-served-by: cache-chi-kigq8000114-CHI, cache-mxp6975-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:43 GMT
server: nginx
x-timer: S1721290911.778809,VS0,VE6
etag: W/"65e6b637-315"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: 552aad89-325f-11ef-b993-de70e4427182
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 79, 0

GET
H2 200 css__T7twZATSz9YDtA4CEs3XoRq-lmvsWC1-9rzLrGpoWuY__jYMOyCwkeeWX4KvLeu7GhjzHVkW5HDKp2hWWBDkyRSE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 14 KB
3 KB 99ms
98ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__T7twZATSz9YDtA4CEs3XoRq-lmvsWC1-9rzLrGpoWuY__jYMOyCwkeeWX4KvLeu7GhjzHVkW5HDKp2hWWBDkyRSE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

76aefb325bdfaf3c67be7591a00c96105ffa1a3eda8cfc16d6d5e1affa8e3f95

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Wed, 09 Jul 2025 06:38:58 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-l749x
content-length: 2632
x-served-by: cache-chi-klot8100179-CHI, cache-mxp6926-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:45 GMT
server: nginx
x-timer: S1721290911.778801,VS0,VE5
etag: W/"65e6b639-3962"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: c1555f1c-3cf4-11ef-93e7-0e97991a7547
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 78, 0

GET
H2 200 css__cPPXTJ7LS3TkqOr2dWhu9Zyqf3tfJ7ROJIBrc4faLpI__FwTXCQ-S705F3IVDki0NUMzBJ8oRlS2Lb0Atw9pp7LE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 512 B
511 B 107ms
105ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__cPPXTJ7LS3TkqOr2dWhu9Zyqf3tfJ7ROJIBrc4faLpI__FwTXCQ-S705F3IVDki0NUMzBJ8oRlS2Lb0Atw9pp7LE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9b3c52df9ce6473c11ee62f85cd48a7ff2b24ad8543ed415fec5124605a987f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 78, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-m255z
content-length: 230
x-served-by: cache-chi-kigq8000068-CHI, cache-mxp6968-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Tue, 05 Mar 2024 06:05:46 GMT
server: nginx
x-timer: S1721290911.778772,VS0,VE5
etag: W/"65e6b63a-200"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: d804a972-f1d7-11ee-976d-4e9dd3d547b2
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:03 GMT

GET
H2 200 css__RtPfTjThw7JiCEZr8aCFs0ovY-ZonvJYBpW2tzv6iRI__hoYIfBUPIWctuKqU_lrnnqDtJnf9B9QEu7jjix36RIM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 3 KB
1 KB 101ms
100ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__RtPfTjThw7JiCEZr8aCFs0ovY-ZonvJYBpW2tzv6iRI__hoYIfBUPIWctuKqU_lrnnqDtJnf9B9QEu7jjix36RIM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5f8d1adf76eaaf2f3592e5a5633ef8722740af2424b1737d85c1d9581588884f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Fri, 27 Jun 2025 04:07:49 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-l749x
content-length: 1172
x-served-by: cache-chi-kigq8000154-CHI, cache-mxp6929-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:52 GMT
server: nginx
x-timer: S1721290911.778765,VS0,VE5
etag: W/"65e6b640-c8c"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: a6a59393-3371-11ef-8b05-0e97991a7547
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 58, 17, 0

GET
H2 200 css__UYLIEJhZ7iPfgPAKjuslVw3CRCFKt3OfxTJjge8A6Hg__fjua13AgyzmqodcGsNUIVue50ndbutts1ntJbzGK_o4__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 506 B
544 B 98ms
97ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__UYLIEJhZ7iPfgPAKjuslVw3CRCFKt3OfxTJjge8A6Hg__fjua13AgyzmqodcGsNUIVue50ndbutts1ntJbzGK_o4__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4953a30def5d6eb8aa0119f918104b5069d10696ee634288c068accf06bb44e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 16, 17, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-64b977755d-fn6sp
content-length: 175
x-served-by: cache-chi-kigq8000153-CHI, cache-mxp6937-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01
last-modified: Tue, 05 Mar 2024 06:05:53 GMT
server: nginx
x-timer: S1721290911.778730,VS0,VE4
etag: W/"65e6b641-1fa"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: e596f71a-f1d7-11ee-89fc-2e39b17a00a2
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:26 GMT

GET
H2 200 css__aUSIons1JLpznAkAWe4wYFCe4_fmTTJTOhtdC4xIAuM__HAl4ITsYWBEO7VRahEwWwi88zkLUBwPm3j4nnx8DeS0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 454 B
468 B 101ms
100ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__aUSIons1JLpznAkAWe4wYFCe4_fmTTJTOhtdC4xIAuM__HAl4ITsYWBEO7VRahEwWwi88zkLUBwPm3j4nnx8DeS0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

fe9132775150b13960723fdffd15ef8bb7f07d120787874114ac9e3d4f303f46

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sun, 22 Jun 2025 00:18:26 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-56d7969b4f-msw7d
content-length: 221
x-served-by: cache-chi-kigq8000054-CHI, cache-mxp6943-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:54 GMT
server: nginx
x-timer: S1721290911.778724,VS0,VE5
etag: W/"65e6b642-1c6"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: c778cb20-2f63-11ef-9f89-ba784693dba0
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 17, 0

GET
H2 200 css__DJVWsB9CJVs_1IGdy-_cGuq4r6SVVaWbEnbS1U2p6y4__7g40UeM74r8hkrzDC6Hbb7RReIGNu-Jsb5XAbAPKIeA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 502 B
591 B 100ms
99ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__DJVWsB9CJVs_1IGdy-_cGuq4r6SVVaWbEnbS1U2p6y4__7g40UeM74r8hkrzDC6Hbb7RReIGNu-Jsb5XAbAPKIeA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b9c823db89be14289e3b0585970e3d91c3313ec9f82d13c9cb24d90820efc699

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Jun 2025 10:17:05 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-766d899d75-fzdtp
content-length: 252
x-served-by: cache-chi-klot8100023-CHI, cache-mxp6935-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:55 GMT
server: nginx
x-timer: S1721290911.778720,VS0,VE5
etag: W/"65e6b643-1f6"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: 42eebcb4-20c9-11ef-a8e2-12b292f98399
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 17, 0

GET
H2 200 css__o5tk1Sc0QNaikp-qb6PDIJi_LXPkfQZHTxlvWxiG4cA__afd6HnnR0psI0sfippmnwgZS958AUTsIqEne3K05XvQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 5 KB
2 KB 106ms
105ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__o5tk1Sc0QNaikp-qb6PDIJi_LXPkfQZHTxlvWxiG4cA__afd6HnnR0psI0sfippmnwgZS958AUTsIqEne3K05XvQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7e9433a7e4538237be585d3d84e1603595879c286be61e26dd3e628e3fd5e206

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 17, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175938
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-vp8bw
content-length: 2091
x-served-by: cache-chi-klot8100098-CHI, cache-mxp6951-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Tue, 05 Mar 2024 06:05:56 GMT
server: nginx
x-timer: S1721290911.778691,VS0,VE6
etag: W/"65e6b644-1218"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: e5943fb9-f1d7-11ee-835d-6255bad32892
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:26 GMT

GET
H2 200 css__ZDvn-N8wxxyBR7KgfbRzIHM0mGwT9doN0fs3f10b_Go__b98SsVi1Bn9KY5Ur3SIgLXOvEMppxbzl1YiFYp9d4Lw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 128 B
466 B 106ms
105ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__ZDvn-N8wxxyBR7KgfbRzIHM0mGwT9doN0fs3f10b_Go__b98SsVi1Bn9KY5Ur3SIgLXOvEMppxbzl1YiFYp9d4Lw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c712b85f4d57c41bb049c80303067da9790aa76b32a41b422174bd507695f444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Wed, 16 Jul 2025 19:36:26 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-mkc4s
content-length: 118
x-served-by: cache-chi-klot8100059-CHI, cache-mxp6961-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:47 GMT
server: nginx
x-timer: S1721290911.778679,VS0,VE5
etag: W/"65e6b63b-80"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: 86c5b039-42e1-11ef-9210-820e48de5c61
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 75, 0

GET
H2 200 css__dn-cpI1YtkU_iLHgA5WhlkxgYWyat_IxjF_B-WSYrpE__a9hIbt0eaZ7d5nhwnm2weG8R_2eXK4EvoOx9dOxouHE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 203 B
486 B 101ms
100ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__dn-cpI1YtkU_iLHgA5WhlkxgYWyat_IxjF_B-WSYrpE__a9hIbt0eaZ7d5nhwnm2weG8R_2eXK4EvoOx9dOxouHE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f66578f61dcd2d00bb8b7a0c5a7a02d39871c2e7c4615826c4e3a6a879a1a66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Wed, 11 Jun 2025 01:59:45 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-845bccb87b-s649l
content-length: 137
x-served-by: cache-chi-klot8100122-CHI, cache-mxp6927-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:56 GMT
server: nginx
x-timer: S1721290911.778674,VS0,VE5
etag: W/"65e6b644-cb"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: 1c673fac-26cd-11ef-a8ca-6e88d504bb51
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 17, 0

GET
H2 200 css__ipUqqBUxEUOLXG_AXF5OCY1hi5eq8oz7Wu0QleOzxj4__-6ZHnf2EVvcL4izgd6S5myiQ-LuyKAuDqa-1hfKmAoI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 99 B
372 B 100ms
100ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__ipUqqBUxEUOLXG_AXF5OCY1hi5eq8oz7Wu0QleOzxj4__-6ZHnf2EVvcL4izgd6S5myiQ-LuyKAuDqa-1hfKmAoI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a0d9d290c9928affdd7f2816a574b367cbd6aca7ff1ba7b14b3391330d6f1995

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Wed, 11 Jun 2025 11:24:22 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-845bccb87b-srflh
content-length: 100
x-served-by: cache-chi-klot8100084-CHI, cache-mxp6933-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:58 GMT
server: nginx
x-timer: S1721290911.778638,VS0,VE5
etag: W/"65e6b646-63"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: fc2a0d8d-271b-11ef-a75e-a2ab8c7907d3
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 57, 17, 0

GET
H2 200 css__A19mhhFH8iX9Ft_oM_oZIcxue6YTAguNiWQN5VaIXQY__dFQUh1vb7jTgHR4jKzrw8DrsdYIarxRbpVmMKCWYgXU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 493 KB
118 KB 105ms
104ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__A19mhhFH8iX9Ft_oM_oZIcxue6YTAguNiWQN5VaIXQY__dFQUh1vb7jTgHR4jKzrw8DrsdYIarxRbpVmMKCWYgXU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

24dd593caf98fe7183e48e16a5a827ab4eb1a734a9821b497689127e68774db1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sun, 06 Jul 2025 23:26:15 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: MISS, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-x24lf
content-length: 120174
x-served-by: cache-chi-kigq8000100-CHI, cache-mxp6957-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:48 GMT
server: nginx
x-timer: S1721290911.778616,VS0,VE5
etag: W/"65e6b63c-7b4f7"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: f9a37d6a-3b25-11ef-a111-0a5f4b927256
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 79, 0

GET
H2 200 css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 2 MB
300 KB 106ms
106ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

8117b5d7ba159bfb0cf341d96a566b4b06c466a0038eca2273a8533b1536e019

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sat, 21 Jun 2025 13:27:13 GMT
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-56d7969b4f-nzfgb
content-length: 307198
x-served-by: cache-chi-kigq8000037-CHI, cache-mxp6931-MXP, cache-mxp6972-MXP
last-modified: Thu, 20 Jun 2024 13:27:07 GMT
server: nginx
x-timer: S1721290911.793958,VS0,VE5
etag: W/"66742e2b-1f7287"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: ce42fc2e-2f08-11ef-b403-3a4931867672
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 17, 0

GET
H2 200 css___VkyRO3B5Aq6aNIr0ttm3Is69Rc7XYN_AdFjRz9E6sA__VcIbQquJvVVOuzIFHQnbacZLWNY0lFxoxf5twuCo0Bc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
www.forcepoint.com/sites/default/files/advagg_css/ 6 KB
2 KB 160ms
158ms Stylesheet
text/css 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_css/css___VkyRO3B5Aq6aNIr0ttm3Is69Rc7XYN_AdFjRz9E6sA__VcIbQquJvVVOuzIFHQnbacZLWNY0lFxoxf5twuCo0Bc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ee27e3cdc69e172aac4b82b3f20d30a2e9b8fc56e7154475292f0ce338b8a5a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sat, 05 Jul 2025 06:37:08 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-llvxv
content-length: 1421
x-served-by: cache-chi-kigq8000092-CHI, cache-mxp6960-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:59 GMT
server: nginx
x-timer: S1721290911.021628,VS0,VE5
etag: W/"65e6b647-19a6"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: d63b43a8-39cf-11ef-ab89-ee120c8775da
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 15, 0

GET
H2 200 forcepoint.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/ 2 KB
1 KB 108ms
107ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/forcepoint.svg

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c7397ae13ad9d12bf4ce9100756dd8703b515ac4381bdd33638e22c787c0fb39

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 29, 103, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-jjllv
content-length: 783
x-served-by: cache-chi-klot8100172-CHI, cache-mxp6943-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:36:00 GMT
server: nginx
x-timer: S1721290911.794005,VS0,VE5
etag: W/"66958830-6ad"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 1708bde2-4345-11ef-bfff-92b70a8cdf9e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 17 Jul 2025 07:29:09 GMT

GET
H2 200 about_us_0.svg
www.forcepoint.com/sites/default/files/ 2 KB
1 KB 107ms
107ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/about_us_0.svg?itok=3xrS9jXe

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

98bee51ffbb032cfea01030abf23549c6d762f6d8283599e52bfb089f01b8742

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 79, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-nf2vw
content-length: 866
x-served-by: cache-chi-kigq8000108-CHI, cache-mxp6955-MXP, cache-mxp6972-MXP
last-modified: Wed, 18 Oct 2023 11:53:36 GMT
server: nginx
x-timer: S1721290911.793909,VS0,VE6
etag: W/"652fc740-76e"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: b5fb8a20-414d-11ef-b54a-f60fc8a2deb7
cache-control: max-age=31622400
accept-ranges: bytes
expires: Mon, 14 Jul 2025 19:25:49 GMT

GET
H2 200 our_approach_0.svg
www.forcepoint.com/sites/default/files/ 3 KB
1 KB 66ms
66ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/our_approach_0.svg?itok=XjvgKmGS

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3058f7c617c39b1a94849fa7223c2f756437af3f215155d37c2a29c36848e28d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 1, 75, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-6b7857bbbb-dfbjw
content-length: 1012
x-served-by: cache-chi-klot8100045-CHI, cache-mxp6977-MXP, cache-mxp6972-MXP
last-modified: Wed, 18 Oct 2023 11:53:58 GMT
server: nginx
x-timer: S1721290911.874593,VS0,VE4
etag: W/"652fc756-a97"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: ed384747-1856-11ef-a9e0-26ad238f469f
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 23 May 2025 16:18:29 GMT

GET
H2 200 our_customers_0.svg
www.forcepoint.com/sites/default/files/ 2 KB
1 KB 66ms
66ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/our_customers_0.svg?itok=pljm0BZO

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c2a54667fcd4151ef9a27b18f84f24c0b884fe593302ca1eb1210d114f4bd06b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 76, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-684rx
content-length: 913
x-served-by: cache-chi-kigq8000075-CHI, cache-mxp6926-MXP, cache-mxp6972-MXP
last-modified: Wed, 18 Oct 2023 11:54:19 GMT
server: nginx
x-timer: S1721290911.875492,VS0,VE5
etag: W/"652fc76b-9af"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 31a8bc86-304e-11ef-aacb-96169af5812a
cache-control: max-age=31622400
accept-ranges: bytes
expires: Mon, 23 Jun 2025 04:16:27 GMT

GET
H2 200 fp_one_icon_12.svg
www.forcepoint.com/sites/default/files/ 1 KB
1 KB 68ms
62ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/fp_one_icon_12.svg?itok=mLSyqP7-

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 76, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-l79x9
content-length: 725
x-served-by: cache-chi-kigq8000075-CHI, cache-mxp6970-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Mon, 18 Mar 2024 16:01:42 GMT
server: nginx
x-timer: S1721290911.973878,VS0,VE4
etag: W/"65f86566-5ed"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: db750a4b-f1d7-11ee-a7b0-d6145dabcebb
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:09 GMT

GET
H2 200 fp_one_icon-hover_12.svg
www.forcepoint.com/sites/default/files/ 1 KB
1 KB 74ms
68ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/fp_one_icon-hover_12.svg?itok=lvMOGlA6

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 76, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-64b977755d-kk5rj
content-length: 737
x-served-by: cache-chi-kigq8000131-CHI, cache-mxp6947-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01
last-modified: Mon, 18 Mar 2024 16:01:47 GMT
server: nginx
x-timer: S1721290911.973940,VS0,VE5
etag: W/"65f8656b-5fb"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: db770500-f1d7-11ee-b87b-f2654297ce89
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:09 GMT

GET
H2 200 fp_one_icon_0.svg
www.forcepoint.com/sites/default/files/ 1 KB
1 KB 72ms
66ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/fp_one_icon_0.svg?itok=eKi29PlI

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 75, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-rszwb
content-length: 725
x-served-by: cache-chi-klot8100050-CHI, cache-mxp6951-MXP, cache-mxp6972-MXP
last-modified: Wed, 18 Oct 2023 11:35:43 GMT
server: nginx
x-timer: S1721290911.973807,VS0,VE4
etag: W/"652fc30f-5ed"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: a9989269-3901-11ef-ba53-d260c23d87a7
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Jul 2025 06:01:17 GMT

GET
H2 200 fp_one_icon-hover_0.svg
www.forcepoint.com/sites/default/files/ 1 KB
1 KB 77ms
71ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/fp_one_icon-hover_0.svg?itok=ecRnPBsZ

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 77, 0
date: Thu, 18 Jul 2024 08:21:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-6v4d5
content-length: 737
x-served-by: cache-chi-kigq8000145-CHI, cache-mxp6971-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Wed, 18 Oct 2023 11:35:50 GMT
server: nginx
x-timer: S1721290911.973788,VS0,VE14
etag: W/"652fc316-5fb"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: d8a93da4-f1d7-11ee-b900-62d8d57276c4
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:05 GMT

GET
H2 200 cyber_edu_icon.svg
www.forcepoint.com/sites/default/files/ 2 KB
1 KB 124ms
118ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/cyber_edu_icon.svg?itok=XXkKE01K

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

fad8df5718762444a80e745fd3b375ecfee298b37c480de5134b8a0ed05bc7a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 76, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-x24lf
content-length: 813
x-served-by: cache-chi-klot8100039-CHI, cache-mxp6965-MXP, cache-mxp6972-MXP
last-modified: Wed, 18 Oct 2023 12:02:27 GMT
server: nginx
x-timer: S1721290911.018967,VS0,VE5
etag: W/"652fc953-9a9"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 649a3ed4-3829-11ef-a111-0a5f4b927256
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 03 Jul 2025 04:13:10 GMT

GET
H2 200 cyber_edu_icon-hover.svg
www.forcepoint.com/sites/default/files/ 3 KB
1 KB 123ms
117ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/cyber_edu_icon-hover.svg?itok=ymKcsOZ4

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2528d731c4e61e67f78982f202d1de7e6f7a234117b4d9c98325c27e33c6e1d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 29, 136, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-64b977755d-5zbrs
content-length: 869
x-served-by: cache-chi-kigq8000147-CHI, cache-mxp6977-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01
last-modified: Wed, 18 Oct 2023 12:02:37 GMT
server: nginx
x-timer: S1721290911.019580,VS0,VE5
etag: W/"652fc95d-b0c"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: dc5b370e-f1d7-11ee-bbb7-623f168e5bfe
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:11 GMT

GET
H2 200 turkish-ransomware-i-hero.png
www.forcepoint.com/sites/default/files/styles/1180x346_sc/public/hero/ 230 KB
235 KB 187ms
181ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/1180x346_sc/public/hero/turkish-ransomware-i-hero.png?itok=jJ8gZgn8&timestamp=1720786293

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ac549b887c22d68ffc9963e419cb31015a2305200948d06f3ca24c67b1986d81

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .fonts.net .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com .ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com .nr-data.net .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com .theadex.com .aumago.com .driftqa.com .scribblecdn.net .esg-global.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .clickagy.com .nimblestory.com .usemessages.com .stackadapt.com .googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com; img-src * data: ; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com .hubspot.com .hubspot.net .demdex.net .libsyn.com .youtube.com; font-src 'self' .google.com .googleadservices.com; connect-src 'self' .vwo.com .demdex.net .omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net .theadex.com .aumago.com .google-analytics.com .6sc.co .adnxs.com .vidyard.com .6sense.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com api.hubapi.com .hsforms.net .hsforms.com .s3.amazonaws.com .drift.com .clickagy.com .facebook.com .zoominfo.com geolocation-db.com dn.linkedin.oribi.io .hubspot.com .hscollectedforms.net .stackadapt.com .google.com .googletagmanager.com .googleadservices.com google.com .googlesyndication.com .linkedin.com .redditstatic.com .reddit.com .g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 139, 0
content-security-policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report
strict-transport-security: max-age=18410000; includeSubDomains; preload
x-content-type-options: nosniff
date: Thu, 18 Jul 2024 08:21:51 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-etou8240192
age: 181209
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, MISS
fastly-io-info: ifsz=271023 idim=1180x346 ifmt=png ofsz=235250 odim=1180x346 ofmt=webp
from-origin: same, https://analyticsssl.forcepoint.com,https://vidyard.com
http_x_geo_continent: EU
fastly-stats: io=1
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 235250
x-xss-protection: 1
x-served-by: cache-chi-klot8100058-CHI, cache-ams2100113-AMS, cache-ams2100143-AMS, cache-mxp6972-MXP
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-timer: S1721290911.018894,VS0,VE17
etag: "ARyepglzjQOVSsVALQBrVpjm+jPHwzXO+BUs0BEKM50"
x-frame-options: SAMEORIGIN
vary: Accept
content-type: image/webp
x-styx-req-id: 45451697-404b-11ef-9a42-ee9e1dde6fad
cache-control: no-cache, must-revalidate
accept-ranges: bytes
x-drupal-cache: MISS
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-p5mqc

GET
H2 200 turkish-ransomware-i-1.png
www.forcepoint.com/sites/default/files/ 36 KB
37 KB 104ms
98ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-1.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ec5d5e9a8573943abc88da8c47fead83a877d69e64c69b339dbc9a893da055c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 43, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: img04-europe-west3
age: 503161
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=94838 idim=780x546 ifmt=png ofsz=37140 odim=780x546 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-w9nrv
content-length: 37140
x-served-by: cache-chi-klot8100176-CHI, cache-ams21039-AMS, cache-ams2100113-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018995,VS0,VE2
etag: "uNJWYqypNdOFqJmH83PVKUgACyMkCigVg7DzHvW+e3w"
vary: Accept
content-type: image/webp
x-styx-req-id: 4544c800-404b-11ef-9aee-de70e4427182
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:35:50 GMT

GET
H2 200 turkish-ransomware-i-2.png
www.forcepoint.com/sites/default/files/ 31 KB
31 KB 106ms
101ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-2.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

212f36154bde29fb1769244168fa4f40e77315fffa6ae42fff232062f8ed7a0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 15, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240194
age: 504071
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=41997 idim=826x110 ifmt=png ofsz=31446 odim=826x110 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-4fsf9
content-length: 31446
x-served-by: cache-chi-kigq8000172-CHI, cache-ams21033-AMS, cache-ams21074-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018877,VS0,VE2
etag: "jzQ8GBMoXnuRL+FfzQxIWPtysQpwUUT2P4Sh4XwoW5E"
vary: Accept
content-type: image/webp
x-styx-req-id: 26ce45c6-4049-11ef-9bc7-0e47c8ff5b51
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:20:39 GMT

GET
H2 200 turkish-ransomware-i-3.png
www.forcepoint.com/sites/default/files/ 91 KB
91 KB 105ms
100ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-3.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

83fb1040f8f7dc9b42904b8ea0507b1fec248e2ffa8a0ad32d8f00357e9a01f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 15, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240194
age: 504069
http_x_geo_region: DE-BY
x-cache: MISS, HIT, HIT, HIT
fastly-io-info: ifsz=117661 idim=678x288 ifmt=png ofsz=92758 odim=678x288 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-w9nrv
content-length: 92758
x-served-by: cache-chi-klot8100129-CHI, cache-ams2100120-AMS, cache-ams21082-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018789,VS0,VE2
etag: "nozWbhv5GyIfBKBAWhuYwI93wz2hbpGsupWE4bsRPB4"
vary: Accept
content-type: image/webp
x-styx-req-id: 27d07c78-4049-11ef-9aee-de70e4427182
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:20:41 GMT

GET
H2 200 turkish-ransomware-i-4.png
www.forcepoint.com/sites/default/files/ 201 KB
202 KB 109ms
104ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-4.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2caf6812d133b2fc835155902536bee390fd4dca3f8d6cc7e62f7081e27debf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 15, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: img04-europe-west3
age: 504065
http_x_geo_region: DE-BY
x-cache: MISS, HIT, HIT, HIT
fastly-io-info: ifsz=257987 idim=651x492 ifmt=png ofsz=205972 odim=651x492 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-m7qcg
content-length: 205972
x-served-by: cache-chi-kigq8000079-CHI, cache-ams21058-AMS, cache-ams21041-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018772,VS0,VE2
etag: "oHWJWJttw0bnLGZnFhZPzYI2EwL+ygi+OHB7hhgxPhY"
vary: Accept
content-type: image/webp
x-styx-req-id: 2a687027-4049-11ef-8cd9-222e41344d78
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:20:46 GMT

GET
H2 200 turkish-ransomware-i-5.png
www.forcepoint.com/sites/default/files/ 241 KB
241 KB 108ms
103ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-5.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c309dbbe647bbf8904cf5cf33833f02fdc6e00c6bb5a95cdf9f29fac4e662207

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 15, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240196
age: 504069
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=455605 idim=654x375 ifmt=png ofsz=246462 odim=654x375 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-p5mqc
content-length: 246462
x-served-by: cache-chi-kigq8000149-CHI, cache-ams21070-AMS, cache-ams21028-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018757,VS0,VE2
etag: "4Ae9OqXfzWlFdFxrwoYhxmMkd/MRxTKqY1mAK5GZXX4"
vary: Accept
content-type: image/webp
x-styx-req-id: 27b7d23b-4049-11ef-9a42-ee9e1dde6fad
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:20:41 GMT

GET
H2 200 turkish-ransomware-i-6.png
www.forcepoint.com/sites/default/files/ 69 KB
70 KB 110ms
104ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-6.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

33b9732e0e2aa2683522382286b86715ec85f147959f352137f49a1d4feb79a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 33, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240195
age: 504057
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=88301 idim=666x151 ifmt=png ofsz=70858 odim=666x151 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-z4chc
content-length: 70858
x-served-by: cache-chi-klot8100125-CHI, cache-ams2100121-AMS, cache-ams21052-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018744,VS0,VE2
etag: "KbwlYUTXJtoVwKP//Ky7Llr4VG9+FuJ6ur+S0DozwBo"
vary: Accept
content-type: image/webp
x-styx-req-id: 2f326baa-4049-11ef-8ee1-8245d19189a9
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:20:54 GMT

GET
H2 200 turkish-ransomware-i-7.png
www.forcepoint.com/sites/default/files/ 78 KB
79 KB 107ms
102ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-7.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b59117aaaa77098f07b611fff721f582ad56daaf3a460dc4161c29172632918d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 14, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240196
age: 504070
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=111582 idim=689x271 ifmt=png ofsz=80122 odim=689x271 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-prbvz
content-length: 80122
x-served-by: cache-chi-klot8100088-CHI, cache-ams21052-AMS, cache-ams2100089-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018709,VS0,VE2
etag: "6FlEOaafHr98UWObrJdySNdIam4RI/JaNSHS02D7LOY"
vary: Accept
content-type: image/webp
x-styx-req-id: 271af048-4049-11ef-ad50-1edbf4b9e77b
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:20:40 GMT

GET
H2 200 turkish-ransomware-i-8.png
www.forcepoint.com/sites/default/files/ 129 KB
129 KB 107ms
102ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-8.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

23101a57da5bd64dde755399a7f34a1c69bb4addcdfe003a9aa99d3d022483ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 15, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: img04-europe-west3
age: 503322
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=185201 idim=840x347 ifmt=png ofsz=131744 odim=840x347 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-cr9cd
content-length: 131744
x-served-by: cache-chi-klot8100100-CHI, cache-ams21081-AMS, cache-ams21058-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018695,VS0,VE2
etag: "oXJiF6h7vLunwwxk9Gix0+31TLHd4+ly8lkwGhHkkqY"
vary: Accept
content-type: image/webp
x-styx-req-id: e4f74395-404a-11ef-b3d9-563f282b1988
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:33:08 GMT

GET
H2 200 placeholder_image.png
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ 34 B
417 B 105ms
100ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/placeholder_image.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

735b78ae1f09b1d02ee92b5ad319a189d50d10ecbec4ddd12201885dde3f4945

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 244, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240196
age: 714672
http_x_geo_region: DE-BY
x-cache: MISS, HIT, HIT, HIT
fastly-io-info: ifsz=1272 idim=20x20 ifmt=png ofsz=34 odim=20x20 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-p5mqc
content-length: 34
x-served-by: cache-chi-kigq8000157-CHI, cache-ams21022-AMS, cache-ams21022-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.018702,VS0,VE2
etag: "1Cw1g26qcqy/qXiETpkqMbr8ayhbr57dIxJ0jC+RrrE"
vary: Accept
content-type: image/webp
x-styx-req-id: ced02715-3e5e-11ef-9a42-ee9e1dde6fad
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 11 Jul 2025 01:50:38 GMT

GET
H2 200 snycu-purple.jpg
www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/ 19 KB
24 KB 185ms
180ms Image
image/jpeg 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/snycu-purple.jpg?itok=9YaXm6cf&timestamp=1720181106

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4577c7682212aced0e91a82f5d2e9876a77151bf8f16a8317e8a95fc29c87f8d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .fonts.net .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com .ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com .nr-data.net .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com .theadex.com .aumago.com .driftqa.com .scribblecdn.net .esg-global.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .clickagy.com .nimblestory.com .usemessages.com .stackadapt.com .googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com; img-src * data: ; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com .hubspot.com .hubspot.net .demdex.net .libsyn.com .youtube.com; font-src 'self' .google.com .googleadservices.com; connect-src 'self' .vwo.com .demdex.net .omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net .theadex.com .aumago.com .google-analytics.com .6sc.co .adnxs.com .vidyard.com .6sense.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com api.hubapi.com .hsforms.net .hsforms.com .s3.amazonaws.com .drift.com .clickagy.com .facebook.com .zoominfo.com geolocation-db.com dn.linkedin.oribi.io .hubspot.com .hscollectedforms.net .stackadapt.com .google.com .googletagmanager.com .googleadservices.com google.com .googlesyndication.com .linkedin.com .redditstatic.com .reddit.com .g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 521, 0
content-security-policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report
strict-transport-security: max-age=18410000; includeSubDomains; preload
x-content-type-options: nosniff
date: Thu, 18 Jul 2024 08:21:51 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
fastly-io-served-by: img03-europe-west3
age: 1105115
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, MISS
fastly-io-info: ifsz=19160 idim=570x270 ifmt=jpeg ofsz=19160 odim=570x270 ofmt=jpeg
from-origin: same, https://analyticsssl.forcepoint.com,https://vidyard.com
http_x_geo_continent: EU
fastly-stats: io=1
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 19160
x-xss-protection: 1
fastly-io-warning: Failed to shrink image
x-served-by: cache-chi-kigq8000067-CHI, cache-ams21030-AMS, cache-ams21068-AMS, cache-mxp6972-MXP
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-timer: S1721290911.018634,VS0,VE17
etag: "FQjOeNVYvcbgpj64kR+6Z0Un7v/CzGkmrYHkIMHOUQ0"
x-frame-options: SAMEORIGIN
vary: Accept
content-type: image/jpeg
x-styx-req-id: bef221d4-3acd-11ef-9ce6-065f8a95e18c
cache-control: no-cache, must-revalidate
accept-ranges: bytes
x-drupal-cache: MISS
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-ct69k

GET
H2 200 remcos.jpg
www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/ 26 KB
27 KB 123ms
118ms Image
image/jpeg 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/remcos.jpg?itok=GOEjP2Jd&timestamp=1719232019

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

712e59da51ddbfc83c263cc8c2b6a404d9f3ec89e830f11220db390c5a410456

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 11, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240196
age: 761888
http_x_geo_region: DE-BY
x-cache: HIT, HIT, HIT, HIT
fastly-io-info: ifsz=26884 idim=570x270 ifmt=jpeg ofsz=26884 odim=570x270 ofmt=jpeg
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-z4chc
content-length: 26884
fastly-io-warning: Failed to shrink image
x-served-by: cache-chi-kigq8000149-CHI, cache-ams21078-AMS, cache-ams21078-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.022746,VS0,VE2
etag: "Bj6V4XDrta5qWNJIi+Jp/8es/hc89Whhyy6eiztHJ1g"
vary: Accept
content-type: image/jpeg
x-styx-req-id: a9d41264-3235-11ef-8eb8-8245d19189a9
cache-control: max-age=31622400
accept-ranges: bytes
expires: Wed, 25 Jun 2025 14:25:53 GMT

GET
H2 200 turkish-ransomware-i-hero.png
www.forcepoint.com/sites/default/files/styles/footer_menu_featured_blog/public/hero/ 18 KB
19 KB 117ms
112ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/footer_menu_featured_blog/public/hero/turkish-ransomware-i-hero.png?itok=aF-78Yax

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

04b512735003d45868136e8382b0835e32e8aa2bbe73634cb6a9059bde1f50de

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 2, 0, 225, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240192
age: 504334
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=19611 idim=199x111 ifmt=png ofsz=18888 odim=199x111 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-6m95f
content-length: 18888
x-served-by: cache-chi-klot8100101-CHI, cache-ams21026-AMS, cache-ams21045-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.022400,VS0,VE2
etag: "Fgm3d4a68L15hjo7Gl4iPYFNKA/KUbKsa3gsOoPFXtA"
vary: Accept
content-type: image/webp
x-styx-req-id: 8a69eb0e-4048-11ef-a95a-7a520cdabf04
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 13 Jul 2025 12:16:17 GMT

GET
H2 200 jquery-1.12.4.min.js Show response
code.jquery.com/ 95 KB
33 KB 155ms
49ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.12.4.min.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 6280729
x-cache: HIT, HIT
content-length: 33738
x-served-by: cache-lga21956-LGA, cache-mxp6927-MXP
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1721290911.046362,VS0,VE0
etag: W/"28feccc0-17b8b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 42, 6417

GET
H3 200 jquery-migrate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.4.1/ 13 KB
5 KB 105ms
61ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.4.1/jquery-migrate.min.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

148a74b0921ad78021d716e8032ede1cdaf7ed7279cefd7d2acbe906add12a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 264138
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4374
last-modified: Fri, 24 Feb 2023 02:37:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "63f822fd-1116"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Errc14vPvY1OpoG%2FKI6NuTD%2FXdrUL%2B8QPezuRURBm7z%2BL7tRmMrIwNl8boAhP0P0z10QwEiU4q51QtOxyQclzfQmpRtjAEKaTe9az%2BaTZYKrPl6WjjcpFB2NQqSKd4h5uiEv2e5H"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a510f81ab8ba06d-FRA
expires: Tue, 08 Jul 2025 08:21:51 GMT

GET
H3 200 jquery-ui.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/ 249 KB
56 KB 84ms
62ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/jquery-ui.min.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9528ca634fecad433d044ddd3e6f9ce1f068d5d932dafdbb19d8e6daea1968bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 499458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 56990
last-modified: Fri, 29 Jul 2022 20:40:53 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "62e445d5-de9e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NnSBaUwWrmVBfZ1a51q8r7vcAHAaWwXUVR6VmynrpNMVwN8UOzNNe6KgeUHJ4blgnPq6UvRJnK25on%2BtFM9aJbslOh929TjRFh6zl5XnQIjnoKy%2F0ic8ts27Z6qdDUulg8ZrmGFK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a510f81ab91a06d-FRA
expires: Tue, 08 Jul 2025 08:21:51 GMT

GET
H3 200 jquery.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ 1 KB
1 KB 84ms
62ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 642525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 591
last-modified: Mon, 04 May 2020 16:11:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec1-514"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tKrUQ0RaAVgq0%2F6ftGjK%2FxPLnW%2Fg33BFj3q5CwTf7aQSdY%2FF%2FWsLfFv%2FQNSszbCiidYXzlBmftsVGktXaOMkXiX2rL4IKqz6G16MjOVbyaEoN28Ue56bpCzILj046TK5gf%2BLG4TQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a510f81ab8fa06d-FRA
expires: Tue, 08 Jul 2025 08:21:51 GMT

GET
H3 200 jquery.form.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.form/4.3.0/ 17 KB
6 KB 202ms
181ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.form/4.3.0/jquery.form.min.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd329c644951f3c041200e8279e3c90063ac5b5c8861fe253fca48df7dd8b99c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 498789
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5719
last-modified: Sun, 07 Jun 2020 05:05:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5edc7595-42c6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SM3HQWQAyHo4DMFCXEMtmofAxlb60DwkYeIEOtZOLyj%2BfWvTf%2FIHevK4KTwDgE97qcBeeDzJzSkFcRf7LHYIOmEN1olh%2FPtRzYPzp6j8pPe6xfsUedrjXaJDt07GdHwtZgbvcdtJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a510f81ab94a06d-FRA
expires: Tue, 08 Jul 2025 08:21:51 GMT

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/ 23 KB
6 KB 128ms
42ms Script
application/javascript 2600:9000:235a:3400:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:3400:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ea07860293f07c2308249b8655e8ef4d5c1569accaec066614e9e49190103cbb

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-version-id: ho1Qs_7AJ5mr5ny9KwcltzOLaxCY8Whp
content-encoding: br
via: 1.1 abf16b943a9b4039b87ccdb094d9303e.cloudfront.net (CloudFront)
date: Thu, 18 Jul 2024 08:19:05 GMT
last-modified: Tue, 16 Jul 2024 17:03:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
age: 170
x-amz-server-side-encryption: AES256
etag: W/"2dcc7c313c7551888d9b80c8c5e4d90d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
x-amz-cf-id: HzyNFX2uMdkYEazuYHiGMnGFhxz2M9gvo1FM3e_eQp3welkq-t1BiQ==

GET
H3 200 v2.js Show response
js.hsforms.net/forms/ 482 KB
156 KB 118ms
73ms Script
application/javascript 104.18.141.119
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.141.119 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee3184f88b136b6ad521ec8d57fcf138b0c78172ee82e5d8773998bebac6486d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
age: 248
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.5387/bundles/project-v2.js&cfRay=8a5109749cb42c62-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"56164b8f5dbcf6e65e555e48d5d6176a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.5387/bundles/project-v2.js
date: Thu, 18 Jul 2024 08:21:51 GMT
x-amz-version-id: mnlqbpb.vUvH_hPLxl7NeOxIrfIBia92
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 48ce4c24-bd4f-4c34-bbb0-ec8e01346369
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 48ce4c24-bd4f-4c34-bbb0-ec8e01346369
last-modified: Thu, 06 Jun 2024 13:36:59 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z5nNr2oPP4uRfLDCo1ti8uKT2Ai9yR9eaQJIGU4Rxs95KYilgDFTJbatBDcYh5EooqZJ9kpvCaB%2F5mgISygyvpCzEF2N5n1%2FyAvdIDCz0dBMwShACzEwmrAhQ2uPd%2F4u"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-5s6qd
cf-ray: 8a510f81ce969bb9-FRA
x-amz-cf-id: KVplD-VRfPAESu4Zi025-IJeUIfkyAUCPCHtsM4ypBi9WNn_cV1iMQ==

GET
H2 200 js__W3yM6WBe6ndCsZPBg4n630CPZFPltBmeCyjdVT1DY70__bDRoZCuiGZ0Z97B2lHvbrvG8HsJo-CC3-a0Ia2Sx5bE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 11 KB
5 KB 173ms
168ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__W3yM6WBe6ndCsZPBg4n630CPZFPltBmeCyjdVT1DY70__bDRoZCuiGZ0Z97B2lHvbrvG8HsJo-CC3-a0Ia2Sx5bE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f443007354af04e5d9f0aea2ce21303442752753ce63ab035a6c76d4f06d5d52

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sat, 17 May 2025 05:22:12 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-8688d6cf87-vrdl9
content-length: 4874
x-served-by: cache-chi-kigq8000024-CHI, cache-mxp6930-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:59 GMT
server: nginx
x-timer: S1721290911.022777,VS0,VE5
etag: W/"65e6b647-2a50"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 402786fd-1344-11ef-8bd4-c263bcbaff8d
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 1, 15, 0

GET
H2 200 js__ZyeOaiFuDejQQbhUV7yg7atYZnj4WLfH77o0scv4068__jeShjS1-sEwOx4dbB-NSBsCnxWfNslS1Nkgx4CZngGA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 13 KB
5 KB 179ms
175ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__ZyeOaiFuDejQQbhUV7yg7atYZnj4WLfH77o0scv4068__jeShjS1-sEwOx4dbB-NSBsCnxWfNslS1Nkgx4CZngGA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ff79200e9d0486ad1207f01f3c5918eea0771ded9b1681694da8caaae4c74c1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Mon, 14 Jul 2025 02:55:47 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-mkc4s
content-length: 4854
x-served-by: cache-chi-kigq8000072-CHI, cache-mxp6979-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:49 GMT
server: nginx
x-timer: S1721290911.022364,VS0,VE6
etag: W/"65e6b63d-343a"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 67d8a2cb-40c3-11ef-9210-820e48de5c61
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 76, 0

GET
H2 200 js__2rjlAbBND-YDbAq2rT4GT0FCGSz_kyEdQdZyOStVQdU__SGggvtYH6KAFWT2NGquosWK1SoWokfbyhZ2MaWmzq9I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 547 B
521 B 173ms
168ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__2rjlAbBND-YDbAq2rT4GT0FCGSz_kyEdQdZyOStVQdU__SGggvtYH6KAFWT2NGquosWK1SoWokfbyhZ2MaWmzq9I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

634b615987ef6bc5cf11ff7eb78673aebf61e436dc7a56de0f4b4aa543ccb577

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Tue, 08 Jul 2025 18:20:17 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-5d77cc44f5-cr9cd
content-length: 294
x-served-by: cache-chi-klot8100132-CHI, cache-mxp6938-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:06:00 GMT
server: nginx
x-timer: S1721290911.022324,VS0,VE5
etag: W/"65e6b648-223"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 8fe47ab2-3c8d-11ef-a4c5-563f282b1988
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 15, 0

GET
H2 200 js__5zhFBHWG8cFOCNCpDlj7pwNwFoSGFvQEfYJiiLp0EY8__TNItwctO0QcNBYn10Ft2xshT-_PqYf8Vv6JB7nZ2xKs__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 27 KB
8 KB 173ms
169ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__5zhFBHWG8cFOCNCpDlj7pwNwFoSGFvQEfYJiiLp0EY8__TNItwctO0QcNBYn10Ft2xshT-_PqYf8Vv6JB7nZ2xKs__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

033ea4cefced423a11d0cc62afb56c3b09c16913abe8a891fc578b2f2327a101

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sat, 05 Jul 2025 23:44:02 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175953
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-p5mqc
content-length: 7981
x-served-by: cache-chi-kigq8000113-CHI, cache-mxp6964-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:55 GMT
server: nginx
x-timer: S1721290911.023084,VS0,VE5
etag: W/"65e6b643-6d75"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 4af7c218-3a5f-11ef-94c8-ee9e1dde6fad
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 15, 0

GET
H2 200 js__MK7MzOuOm6Wn1gEArVsBZG7dh82EREyAMIm9mRlUqq8__dORmwcviulacbj4TEHhv8s4qzj-5oUCjfNEX8y-ZUFM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 22 KB
8 KB 171ms
167ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__MK7MzOuOm6Wn1gEArVsBZG7dh82EREyAMIm9mRlUqq8__dORmwcviulacbj4TEHhv8s4qzj-5oUCjfNEX8y-ZUFM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b2da29ed5ab13ba88c22a51b412428640f8b495c40e0225d712d16eb6ea8351e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Mon, 14 Jul 2025 09:05:55 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-dbrtw
content-length: 7765
x-served-by: cache-chi-kigq8000098-CHI, cache-mxp6942-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:06:01 GMT
server: nginx
x-timer: S1721290911.022969,VS0,VE4
etag: W/"65e6b649-59a3"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 1cfe1108-40f7-11ef-b3ae-fa7bcf007e87
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 73, 15, 0

GET
H2 200 js__YT6D1B_BKxvm6JCH_t9sZNI5L6yITa_DlU5QcSlOkAU__OXobH7d1IP1o3WABlniIrU_-pcJacVSIPUv9bpD-6pQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 730 B
725 B 176ms
172ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__YT6D1B_BKxvm6JCH_t9sZNI5L6yITa_DlU5QcSlOkAU__OXobH7d1IP1o3WABlniIrU_-pcJacVSIPUv9bpD-6pQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

67138202cdb85739d98743e8226b60fbef18366ce3da88902bee16dacd0f0959

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-64b977755d-ph6zp
content-length: 381
x-served-by: cache-chi-klot8100120-CHI, cache-mxp6949-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01
last-modified: Tue, 05 Mar 2024 06:05:56 GMT
server: nginx
x-timer: S1721290911.022890,VS0,VE7
etag: W/"65e6b644-2da"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: dd343a59-f1d7-11ee-89af-8edf77054182
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:12 GMT

GET
H2 200 js__udVKtMVyYcbvVHDJ0nPML4nntXexNWL2oMqAdYSCgWM__DGF7DhDt4X72RMZfC0gLtM1DzR4cKNX-xUUTDHAODaQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 27 KB
10 KB 181ms
177ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__udVKtMVyYcbvVHDJ0nPML4nntXexNWL2oMqAdYSCgWM__DGF7DhDt4X72RMZfC0gLtM1DzR4cKNX-xUUTDHAODaQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c3af792cf17fc9da7b301e6ec8a24dcec9e7b4d3ef83622c2417329f658e8848

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Fri, 20 Jun 2025 16:17:46 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-6d4d877cc6-pgkh8
content-length: 10066
x-served-by: cache-chi-klot8100144-CHI, cache-mxp6959-MXP, cache-mxp6972-MXP
last-modified: Tue, 16 Apr 2024 13:54:18 GMT
server: nginx
x-timer: S1721290911.024242,VS0,VE5
etag: W/"661e830a-6bc3"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 76e391db-2e57-11ef-adce-563e7797e590
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 76, 100, 0

GET
H2 200 js__chJL213YSkJch-IjytLyUqW7uGPnNqOcHGrVBTtmWRc__yn2ExM-BDbvoDYxfwBKmliyRc5GwBZkfllb5p--ixOE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 710 B
661 B 165ms
161ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__chJL213YSkJch-IjytLyUqW7uGPnNqOcHGrVBTtmWRc__yn2ExM-BDbvoDYxfwBKmliyRc5GwBZkfllb5p--ixOE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1f81387d932ab97c0ddff8edfc8e1ca4e37201b3cfb5d3911bc25a04e4087ae7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 77, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-64b977755d-ph6zp
content-length: 306
x-served-by: cache-chi-klot8100117-CHI, cache-mxp6970-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01
last-modified: Tue, 05 Mar 2024 06:05:57 GMT
server: nginx
x-timer: S1721290911.022325,VS0,VE4
etag: W/"65e6b645-2c6"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: dd2ddb29-f1d7-11ee-89af-8edf77054182
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:12 GMT

GET
H2 200 js__vqZqTxUxqDoVSZOh60EjSleoZgwIzSlhamQKjS1JngU__S91yqV9ubUDMxzCK2GLBYdp1SFL3v48MFVTVZ3OSXjc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 798 B
728 B 179ms
175ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__vqZqTxUxqDoVSZOh60EjSleoZgwIzSlhamQKjS1JngU__S91yqV9ubUDMxzCK2GLBYdp1SFL3v48MFVTVZ3OSXjc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

0af941ad21ab4dc704f04bdf8d21825869cfe27eb61b3a37e295f70697c48c88

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Tue, 15 Jul 2025 05:16:16 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-jgk2s
content-length: 428
x-served-by: cache-chi-klot8100128-CHI, cache-mxp6939-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:06:02 GMT
server: nginx
x-timer: S1721290911.023683,VS0,VE5
etag: W/"65e6b64a-31e"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 32226950-41a0-11ef-b5d5-c281824f74e2
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 80, 15, 0

GET
H2 200 js__A3z98XA9ArlnbHREYTcp6hgmi5Oz2wY1MqcLV75pq8Q__z2dbLyr7KaPpYQrjLtDeNRJ8Dddotk1Rd-5bC2zRyWo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 981 B
687 B 168ms
164ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__A3z98XA9ArlnbHREYTcp6hgmi5Oz2wY1MqcLV75pq8Q__z2dbLyr7KaPpYQrjLtDeNRJ8Dddotk1Rd-5bC2zRyWo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

33df7d1430b49b83528e5df930e1da6d9bf492fb32b37ff2b9fd4d97834a0abd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Mon, 12 May 2025 21:23:44 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-548957645b-ggnrv
content-length: 452
x-served-by: cache-chi-klot8100097-CHI, cache-mxp6943-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:06:03 GMT
server: nginx
x-timer: S1721290911.022389,VS0,VE5
etag: W/"65e6b64b-3d5"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: becdc4fc-0fdc-11ef-94bd-42e5d22ea1b9
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 15, 0

GET
H2 200 js__BsJj-J0DDipBFUM6jWq6jBgbLlOJHFUDm1oaCirTN8s__3ytciCoM4ry2VdZVK_RnAXm_cZfbyZ0Tj9DCUWBKchw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 3 KB
2 KB 167ms
163ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__BsJj-J0DDipBFUM6jWq6jBgbLlOJHFUDm1oaCirTN8s__3ytciCoM4ry2VdZVK_RnAXm_cZfbyZ0Tj9DCUWBKchw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9e815610f978cad8bc6a72832b206c68e17bf6799cd0c937b2b3c30014243f73

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sun, 25 May 2025 07:15:48 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-6b7857bbbb-dfbjw
content-length: 1539
x-served-by: cache-chi-klot8100066-CHI, cache-mxp6925-MXP, cache-mxp6972-MXP
last-modified: Tue, 19 Mar 2024 19:19:24 GMT
server: nginx
x-timer: S1721290911.022352,VS0,VE5
etag: W/"65f9e53c-d5a"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 721db0cf-199d-11ef-a9e0-26ad238f469f
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 29, 77, 0

GET
H2 200 js__6FQAqJmB1yKdAJYwsXAk_hJnargJPvMPkf9xl2Aoo0E__LRcB_jb8iwtqJJbRU0etTiWNPUen87vOM9Rlp7OZGiI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 32 KB
14 KB 172ms
169ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__6FQAqJmB1yKdAJYwsXAk_hJnargJPvMPkf9xl2Aoo0E__LRcB_jb8iwtqJJbRU0etTiWNPUen87vOM9Rlp7OZGiI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

6806cdcdd3c7f06950968eeebc5ed11dc261adde18cfefd541532fcf5e59ddff

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-h68w5
content-length: 14177
x-served-by: cache-chi-klot8100139-CHI, cache-mxp6966-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Tue, 05 Mar 2024 06:06:03 GMT
server: nginx
x-timer: S1721290911.022543,VS0,VE5
etag: W/"65e6b64b-81b7"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: e592268a-f1d7-11ee-9fa0-220fea7644ee
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:26 GMT

GET
H2 200 js__ZAA5lMeZXVSyc2jkDQc3qK2xTFroqEhe0Vhijw7cweY__awDE3dco34o6B5V5PT-wcPX9t75VGt6sjYxNLg-Ibew__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 6 KB
2 KB 173ms
170ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__ZAA5lMeZXVSyc2jkDQc3qK2xTFroqEhe0Vhijw7cweY__awDE3dco34o6B5V5PT-wcPX9t75VGt6sjYxNLg-Ibew__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c654220d555e70fb63334836085ed53e9a9d2982e79824664fba6d89e6dc490e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sun, 15 Jun 2025 02:01:15 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-6784b9fdcf-2rm2q
content-length: 2104
x-served-by: cache-chi-klot8100167-CHI, cache-mxp6955-MXP, cache-mxp6972-MXP
last-modified: Tue, 16 Apr 2024 13:54:19 GMT
server: nginx
x-timer: S1721290911.022598,VS0,VE5
etag: W/"661e830b-183e"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: fb6795cf-29f1-11ef-95dc-aec8cd48c366
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 3, 78, 0

GET
H2 200 js__VVbwMK3NMLbfvdLXAKRCOGZ9jqUjWHfUrPnJSWIlxkM__4Q4SNExXEfBJWUuxQzqhfoyno0u2-1mPRJyQnRmGPTQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 4 KB
2 KB 170ms
167ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__VVbwMK3NMLbfvdLXAKRCOGZ9jqUjWHfUrPnJSWIlxkM__4Q4SNExXEfBJWUuxQzqhfoyno0u2-1mPRJyQnRmGPTQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

61deedef5519831c5ba93b5ea4ccbe1d3a6a544c37709704271d05871caf1a02

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Wed, 21 May 2025 14:41:43 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175935
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-7d5d4db597-t449s
content-length: 1194
x-served-by: cache-chi-kigq8000035-CHI, cache-mxp6948-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:06:26 GMT
server: nginx
x-timer: S1721290911.021980,VS0,VE6
etag: W/"65e6b662-f33"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 13b2b807-16b7-11ef-ab5f-328758f3d7f2
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 15, 0

GET
H2 200 js__ZW8o7ZZZ2WVdbdwiWGu52bSrkEFZV2xhp5aNyZR5USA__3tGfK_b3yc_EcnR78FUS1iLe24uT_kFOG0Zgxin4wcM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 4 KB
2 KB 180ms
176ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__ZW8o7ZZZ2WVdbdwiWGu52bSrkEFZV2xhp5aNyZR5USA__3tGfK_b3yc_EcnR78FUS1iLe24uT_kFOG0Zgxin4wcM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7a06dd94021db644db9732192dd8c6b062b80d3f99488e35ce495e82f0ccf961

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 24, 41, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175935
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-srsz5
content-length: 1541
x-served-by: cache-chi-klot8100156-CHI, cache-mxp6955-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Tue, 05 Mar 2024 06:06:04 GMT
server: nginx
x-timer: S1721290911.023388,VS0,VE5
etag: W/"65e6b64c-f24"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: e594d3d7-f1d7-11ee-83a9-32c190c1efda
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:26 GMT

GET
H2 200 js__UCtXJrNvJbqWwTkauUyH6r0OmkrsjVeSImxlI3C6DJc__edC3yUE0SEy7im3t18SA-W_kx6imM-y8IQCkdmyHAt0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 4 KB
2 KB 161ms
158ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__UCtXJrNvJbqWwTkauUyH6r0OmkrsjVeSImxlI3C6DJc__edC3yUE0SEy7im3t18SA-W_kx6imM-y8IQCkdmyHAt0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

fd08b09bb992ad9d8eb1fa512716a782939ee1df7c7b10ebecef57bc7b023626

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175935
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-64b977755d-p72wq
content-length: 1260
x-served-by: cache-chi-kigq8000118-CHI, cache-mxp6965-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01
last-modified: Tue, 05 Mar 2024 06:06:05 GMT
server: nginx
x-timer: S1721290911.021920,VS0,VE4
etag: W/"65e6b64d-ebd"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: ea32fd72-f1d7-11ee-b1db-162c3c5c54d7
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:34 GMT

GET
H2 200 js__AV6-fb8rJ2QD61i8dwhUQihn7pc-Lp_VvhfmIjW8oHw__RUm4kKahOBCnrDpJWbA1cDqNhTD7qsBmlLW9ebsLhz0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 5 KB
2 KB 167ms
164ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__AV6-fb8rJ2QD61i8dwhUQihn7pc-Lp_VvhfmIjW8oHw__RUm4kKahOBCnrDpJWbA1cDqNhTD7qsBmlLW9ebsLhz0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a167f660daaa2f0abba7204685eb46f7127b490d936f10747a2f8c5daba26b83

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sat, 21 Jun 2025 22:59:42 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-56d7969b4f-kpvrp
content-length: 1853
x-served-by: cache-chi-klot8100113-CHI, cache-mxp6962-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:50 GMT
server: nginx
x-timer: S1721290911.022261,VS0,VE5
etag: W/"65e6b63e-1377"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: c7e56e84-2f58-11ef-a52a-56441efc25bf
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 79, 77, 0

GET
H2 200 js__Z8_z4Ixa-D0iNdI4Vha8piNlJPIvuqBB03fpnqgg0ZU__7hSyf_bmxpB7an3khq1utmSHnVzI32jc5ywGqSrYb0g__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 3 KB
1 KB 165ms
161ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__Z8_z4Ixa-D0iNdI4Vha8piNlJPIvuqBB03fpnqgg0ZU__7hSyf_bmxpB7an3khq1utmSHnVzI32jc5ywGqSrYb0g__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ece4490c33a7069c08a0e696be3541870684db90df7dbb70205a99dc57973eac

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 79, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175935
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-fddpv
content-length: 1088
x-served-by: cache-chi-kigq8000061-CHI, cache-mxp6934-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Tue, 05 Mar 2024 06:06:18 GMT
server: nginx
x-timer: S1721290911.022385,VS0,VE5
etag: W/"65e6b65a-bee"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: f017d2d1-f1d7-11ee-a6cf-faab7e7aaaa3
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:44 GMT

GET
H2 200 js__3PyHVp_4SRq6pNQOBF08IE7KMR78aq2RPCDHv-23ni8__7F-DhWAuWWcJXOiKyc1JsZkkESiDxwbjA5pvRgf1qdA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 3 KB
2 KB 168ms
165ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__3PyHVp_4SRq6pNQOBF08IE7KMR78aq2RPCDHv-23ni8__7F-DhWAuWWcJXOiKyc1JsZkkESiDxwbjA5pvRgf1qdA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2a4693f2cfab06c8f82a71e57d82363c57e3b93597ea2a9c08c2bb08f83839f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sat, 21 Jun 2025 02:28:28 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175935
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-6d4d877cc6-bqcts
content-length: 1351
x-served-by: cache-chi-kigq8000071-CHI, cache-mxp6971-MXP, cache-mxp6972-MXP
last-modified: Tue, 16 Apr 2024 13:54:19 GMT
server: nginx
x-timer: S1721290911.022883,VS0,VE5
etag: W/"661e830b-d77"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: c76b22be-2eac-11ef-bab3-626bd5dccaba
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 26, 15, 0

GET
H2 200 js__g6mKbcakHxQkz4ZHYaxdO_xqONINvRMgsHh1zAK-fr0__ATHtEmHaeZ0jidpGU22EkhmPDBSgjD8z0bVDQMI-BIY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 2 KB
1 KB 167ms
164ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__g6mKbcakHxQkz4ZHYaxdO_xqONINvRMgsHh1zAK-fr0__ATHtEmHaeZ0jidpGU22EkhmPDBSgjD8z0bVDQMI-BIY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ac12f243172f3c8376a67f24942257093fd70d0c10212a58bf8df60f372be24e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Sun, 29 Jun 2025 22:03:52 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-ct69k
content-length: 762
x-served-by: cache-chi-kigq8000175-CHI, cache-mxp6927-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:59 GMT
server: nginx
x-timer: S1721290911.022122,VS0,VE5
etag: W/"65e6b647-76d"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 4e5db06a-359a-11ef-a5ff-065f8a95e18c
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 20, 18, 0

GET
H2 200 js__zwOQL0xjQu_jInUCc5HDDX7DuqNXThdgsBzScvBN6zY__YDKn5kOzd1mgJhYu7UkUXBFTO-WC5n-FhasqlgTZXKY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 10 KB
4 KB 164ms
161ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__zwOQL0xjQu_jInUCc5HDDX7DuqNXThdgsBzScvBN6zY__YDKn5kOzd1mgJhYu7UkUXBFTO-WC5n-FhasqlgTZXKY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

0eb42d32c51e79e9d48a5694328c0ce8889f58a2c25bf13f239a8d818226a96a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Tue, 10 Jun 2025 05:52:35 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175935
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-59b5bdfd9-jkpwr
content-length: 3791
x-served-by: cache-chi-kigq8000049-CHI, cache-mxp6956-MXP, cache-mxp6972-MXP
last-modified: Tue, 16 Apr 2024 13:54:33 GMT
server: nginx
x-timer: S1721290911.021773,VS0,VE5
etag: W/"661e8319-262c"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 78cf0433-2624-11ef-9069-0ee4d9524d06
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 15, 0

GET
H2 200 js__XtFha_knURVT5YLGKmVYz2S732sgaVuOjO801TC1X90__Iiz_LtHOgN-NEjf_Wqk78-4FPz8AQR7Ygonew_LemTU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 1017 B
803 B 164ms
161ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__XtFha_knURVT5YLGKmVYz2S732sgaVuOjO801TC1X90__Iiz_LtHOgN-NEjf_Wqk78-4FPz8AQR7Ygonew_LemTU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2db23bd96dca0757b0f0d309acb62fe766c08348c86c195ed79658f7f7b456c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Fri, 11 Jul 2025 15:53:46 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-684rx
content-length: 566
x-served-by: cache-chi-kigq8000115-CHI, cache-mxp6920-MXP, cache-mxp6972-MXP
last-modified: Tue, 05 Mar 2024 06:05:51 GMT
server: nginx
x-timer: S1721290911.021785,VS0,VE5
etag: W/"65e6b63f-3f9"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 972fd391-3ed4-11ef-b48b-96169af5812a
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 21, 77, 0

GET
H2 200 js__ANAjsl90aU8V_JJuHtJWcRsK1EGBFuMwHq693fURsXU__F1FPONSTf0yEH0Y9VHtO8-UlYOiMFKhCksEr6rzCrMg__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 2 KB
976 B 162ms
159ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__ANAjsl90aU8V_JJuHtJWcRsK1EGBFuMwHq693fURsXU__F1FPONSTf0yEH0Y9VHtO8-UlYOiMFKhCksEr6rzCrMg__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3180fea88eaa47e87effdffd92cc7f52249a701909b6b617b2d0c55b7a0e7c98

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-h68w5
content-length: 629
x-served-by: cache-chi-kigq8000137-CHI, cache-mxp6981-MXP, cache-mxp6972-MXP
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Tue, 05 Mar 2024 06:06:01 GMT
server: nginx
x-timer: S1721290911.021715,VS0,VE5
etag: W/"65e6b649-61e"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: ddd9505b-f1d7-11ee-9fa0-220fea7644ee
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 04 Apr 2025 16:33:13 GMT

GET
H2 200 js__1DBjoSMQlQ4ixA_cuaJfS5Px949O7h4aDn8Z9xtRW7Q__AT6c7sCefn259J383Kk5L3xgymjOI5hghQofGOoaazQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 21 KB
7 KB 168ms
166ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__1DBjoSMQlQ4ixA_cuaJfS5Px949O7h4aDn8Z9xtRW7Q__AT6c7sCefn259J383Kk5L3xgymjOI5hghQofGOoaazQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7dfeb329f73421a0c80e8a067d3e1d67c916c84746f94cb9826c06bc58516d1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Fri, 27 Jun 2025 13:26:32 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175962
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-ct69k
content-length: 6820
x-served-by: cache-chi-klot8100110-CHI, cache-mxp6955-MXP, cache-mxp6972-MXP
last-modified: Wed, 26 Jun 2024 13:26:03 GMT
server: nginx
x-timer: S1721290911.021713,VS0,VE6
etag: W/"667c16eb-55f3"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b45e7b01-33bf-11ef-a5ff-065f8a95e18c
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 1, 41, 0

GET
H2 200 js__QEUI7Yv_wakfcc6JBvi15ovY1U6doRpL4VmJGHt4na4__bunscNd0XY0JtFyEPHN8vrG4QmOdFsldeaRN0v3VA9M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response
www.forcepoint.com/sites/default/files/advagg_js/ 79 KB
27 KB 161ms
158ms Script
application/x-javascript 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/advagg_js/js__QEUI7Yv_wakfcc6JBvi15ovY1U6doRpL4VmJGHt4na4__bunscNd0XY0JtFyEPHN8vrG4QmOdFsldeaRN0v3VA9M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2da781a6191588a46eeb8e47e2d5c4fd2d49a2eceeb1e6e061dbac289e63dc7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Tue, 15 Jul 2025 04:39:36 GMT
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175935
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-j5hgt
content-length: 26917
x-served-by: cache-chi-klot8100116-CHI, cache-mxp6930-MXP, cache-mxp6972-MXP
last-modified: Mon, 18 Mar 2024 14:45:01 GMT
server: nginx
x-timer: S1721290911.021658,VS0,VE5
etag: W/"65f8536d-13c91"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: 129fac1c-419b-11ef-9963-86c9c527cf44
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 15, 0

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.forcepoint.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=www.forcepoint.com&pId=7334164860651945289

4 B
279 B

328ms
247ms

Image
application/json

2600:9000:206f:fe00:5:7a81:86c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.forcepoint.com&pId=7334164860651945289
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Protocol: H2
Server: 2600:9000:206f:fe00:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:52 GMT
via: 1.1 58b39782bf40f627ace295c1c6f59840.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
content-type: application/json
alt-svc: h3=":443"; ma=86400
content-length: 4
apigw-requestid: bGWJGicaoAMEPYQ=
x-amz-cf-id: 8hpVPsJ90kCXc8FMd525pePuNc3YVod9t07ezKbKwMQvlB62FoTRQQ==

Redirect headers

pragma: no-cache
date: Thu, 18 Jul 2024 08:21:52 GMT
an-x-request-uuid: 0771b508-7a1a-490b-850a-d76e69fa3379
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://attr.ml-api.io/?domain=www.forcepoint.com&pId=7334164860651945289
x-proxy-origin: 80.255.7.106; 80.255.7.106; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/ 434 KB
111 KB 129ms
49ms Script
application/javascript 2600:9000:235a:3400:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:3400:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e6bb0467284ad6bf4b716def881b4ecb16751807121ba3e2fcca55a33c850dc0

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-version-id: 2i6PDnq9Dj4ToerNLa_U9W6mjHKEMpq_
content-encoding: br
via: 1.1 abf16b943a9b4039b87ccdb094d9303e.cloudfront.net (CloudFront)
date: Thu, 18 Jul 2024 08:18:03 GMT
last-modified: Tue, 16 Jul 2024 17:03:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
age: 229
x-amz-server-side-encryption: AES256
etag: W/"0d6f6bedfcf3c993f2460235311eff1a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
x-amz-cf-id: bItjnxNRKyJ-6tjXFhxfAiUl-TQUfil4etvEXLoQSiZRtCSY2CCDnA==

GET
DATA 200
OK truncated
/ 166 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e2a8b16a227605843bcf04d32557fa5f790d17d5fae10db399f3ad6b75cae70

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 450 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77bfa66bf799ef1d5be3e464795aaca2f9a0587c1616b9671f7383623474f455

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 141 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1a5c0fb755eabd84fa9ee65115561abfc934cb67631d8392acc299bed349942d

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 187 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c181c648e71e1f94dc9f3aa0aced539df9790bc1aa92494d7fe7b17c274767bf

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 660 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8892ffd9b6812e96fca28cf2b24a4a1e25711631d73141353f1ec57fcaf523b8

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 372 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6a4f005d0158d27d475991d4606ec4141f42917cc68835019d819c583957710

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 372 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0c810909068da447ca522f9770490722119d254f18905ae37e5e4a45e2c346c

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 248 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de0c91884c0f70a3c8ab477b2637d9c9417fc74eb663bbe6eace7836e8b38fc3

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 chevron-right-xxs.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/ 213 B
556 B 153ms
153ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/chevron-right-xxs.svg

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

eb06d9c1faf512de924b0840e5ff2cea13ea5154e84b9a2edb23c3ee94602bd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 28, 16, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-x5pqn
content-length: 174
x-served-by: cache-chi-kigq8000176-CHI, cache-mxp6945-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:36:00 GMT
server: nginx
x-timer: S1721290911.021592,VS0,VE5
etag: W/"66958830-d5"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 17e28133-4345-11ef-9849-f21714ecd673
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 17 Jul 2025 07:29:10 GMT

GET
DATA 200
OK truncated
/ 636 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e25fa89bb49f7875384fe86ddb39c8c0a966f7aff529e4aa1e761efe8909fdad

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 636 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8048b6a47a7795c53151c7d28f992a190da59cfa9416a171a03652359a964f2a

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 636 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 68cb94151d86903ee4b3a5088e233b408a81a7faf9bb97d1172d8e3e6a83f868

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 banner-woman.jpg
www.forcepoint.com/sites/default/files/ 12 KB
13 KB 98ms
98ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/banner-woman.jpg

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b9b8fe9d0d7983bd3dc05016caf09d5028c4525e9beba05ecf0ed85bd0f3f86a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 242, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240195
age: 1908818
http_x_geo_region: DE-BY
x-cache: HIT, HIT, HIT, HIT
fastly-io-info: ifsz=139269 idim=591x426 ifmt=jpeg ofsz=12712 odim=591x426 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-fff8fdb6d-mgt8t
content-length: 12712
x-served-by: cache-chi-klot8100073-CHI, cache-ams2100085-AMS, cache-ams2100120-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.021570,VS0,VE2
etag: "N0lQYBtHe5ciagpRVpui8m2mvIrccgSXz/6JZdtfgoA"
vary: Accept
content-type: image/webp
x-styx-req-id: 5fd10c48-1254-11ef-8773-22ec67fc409e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 16 May 2025 00:45:06 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ff35e1bb0b3e1cb03aa7eab3fb0f74381ec3fd6fcff85d8c4f6be72abae116a0

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1652e3fbc6cef41f94897b295b6b1f57fa4901a3727e4c9ecb2911614531d0f

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 750 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 26e256bfa2011f9fbbe0e81f2515c98b94b7ee7696a82f380cb7e7c8361e04a4

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H2 200 ajax-loader.gif
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ 365 B
763 B 96ms
96ms Image
image/gif 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ajax-loader.gif

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

195211df418c32079abb41bb0ebd2ea3aace287509a9c49702d80f1350313527

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 1491, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240193
age: 3489850
http_x_geo_region: DE-BY
x-cache: MISS, HIT, HIT, HIT
fastly-io-info: ifsz=404 idim=43x11 ifmt=gif ofsz=365 odim=43x11 ofmt=gif ofrm=4
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-59b5bdfd9-hr6dk
content-length: 365
x-served-by: cache-chi-klot8100112-CHI, cache-ams21053-AMS, cache-ams21053-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.021534,VS0,VE2
etag: "c9vdSz1SobFgJvEEIebuVOe3obQGnXd87HeEFJfv0io"
vary: Accept
content-type: image/gif
x-styx-req-id: 579b5b57-2521-11ef-bcb1-92bc69777a0d
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sun, 08 Jun 2025 22:57:40 GMT

GET
H2 200 bg-blog-podcast-final-plea.png
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/backgrounds/ 136 KB
137 KB 95ms
95ms Image
image/webp 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/backgrounds/bg-blog-podcast-final-plea.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

defd01b0db74c62e4efe18ef38e5ec968f2b8c2cf51ab6b14f12e1ad250eec84

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 71, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: img03-europe-west3
age: 2366693
http_x_geo_region: DE-BY
x-cache: HIT, MISS, HIT, HIT
fastly-io-info: ifsz=236236 idim=580x458 ifmt=png ofsz=139710 odim=580x458 ofmt=webp
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-a-56d7969b4f-tq26q
content-length: 139710
x-served-by: cache-chi-kigq8000133-CHI, cache-ams21032-AMS, cache-ams21032-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.021516,VS0,VE2
etag: "J4HM7COV6lmZQG/n7TaO0MtxZmafgyzKI2fNbOojs8E"
vary: Accept
content-type: image/webp
x-styx-req-id: 6555f2fb-2f58-11ef-a04e-8e5f079c444d
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 21 Jun 2025 22:56:57 GMT

GET
H2 200 f-white.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/ 257 B
369 B 146ms
145ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/f-white.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2a7b733b2f19d538893df08b2c194aef1201dbad6ee2ddafc5bcd34cbb482d6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-a-67db8dc7b8-d8mdp
content-length: 187
x-served-by: cache-chi-klot8100146-CHI, cache-mxp6968-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:36:00 GMT
server: nginx
x-timer: S1721290911.021478,VS0,VE5
etag: W/"66958830-101"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 17e26d46-4345-11ef-879d-66813a86faf3
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 17 Jul 2025 07:29:10 GMT

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6116382548abaad3d6133a60e2dc187d88dfa1ed07d981311c0bbcfaee05cd49

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 icon-anchor-arrow-teal.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/ 655 B
782 B 144ms
144ms Image
image/svg+xml 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/icon-anchor-arrow-teal.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

29aebe811bb2f84bd90cfdee7ffc4c4af62bb5d871fd683f8a85bf0852ce9163

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 15, 0
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175961
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-8gq4f
content-length: 400
x-served-by: cache-chi-kigq8000077-CHI, cache-mxp6945-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:36:00 GMT
server: nginx
x-timer: S1721290911.021454,VS0,VE5
etag: W/"66958830-28f"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 17e25f95-4345-11ef-92c5-1af899943841
cache-control: max-age=31622400
accept-ranges: bytes
expires: Thu, 17 Jul 2025 07:29:10 GMT

GET
DATA 200
OK truncated
/ 383 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b5c2800c52737f3425d0e434c93f9412da5e0491282c8d3d53b4d707202b8cef

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4cbc6a70cd3d48475ddbb975d3831d02e4158a76fcdb997891baa497ea31241

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 356 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6676353d7029b44112419ac26efd665e84021eb418ccf05a1e1f04d0ba46bd53

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 431 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af60288a11ae9864cdd707a9c6e13463359d5ffb6755bf9035a878f18b8758f9

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 688 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ec291adef932c1e26510f560daef99d2d26b96331cbfd2f29fe234eaf2dddae

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 json Show response
forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/ 47 KB
7 KB 250ms
193ms XHR
application/json 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/json?hs_static_app=forms-embed&hs_static_app_version=1.5387&X-HubSpot-Static-App-Info=forms-embed-1.5387

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a77f86a159e012d113c05ef105506b685a244ffdfa2aa168ca08777af4ff3a64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-origin-hublet: na1
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d9be5ebc-d894-4c9a-a55f-7de009c4957b
x-envoy-upstream-service-time: 21
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d9be5ebc-d894-4c9a-a55f-7de009c4957b
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.forcepoint.com
x-evy-trace-virtual-host: all
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8a510f83ff46bbc9-WAW
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-kvggb

GET
H3 200 json Show response
forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/ 47 KB
7 KB 447ms
197ms XHR
application/json 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/json?hs_static_app=forms-embed&hs_static_app_version=1.5387&X-HubSpot-Static-App-Info=forms-embed-1.5387

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1dcfd61bd8bfca49b2432c76f3d20e19d3244eaf766dea8055283cb623812d8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-origin-hublet: na1
date: Thu, 18 Jul 2024 08:21:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 9b902e0c-2343-4dd3-a1c5-750de9c0b60c
x-envoy-upstream-service-time: 21
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9b902e0c-2343-4dd3-a1c5-750de9c0b60c
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.forcepoint.com
x-evy-trace-virtual-host: all
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8a510f85290bbbc9-WAW
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-gqvlc

GET
H2 200 loading.gif
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ 76 KB
77 KB 50ms
50ms Image
image/gif 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/loading.gif

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3f3a06c93db350a7a9d3616a3dbbd6c252e702ade48978256c8a125fc2981d2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0, 176, 1
strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Thu, 18 Jul 2024 08:21:51 GMT
fastly-io-served-by: vpop-etou8240193
age: 1843321
http_x_geo_region: DE-BY
x-cache: MISS, MISS, HIT, HIT
fastly-io-info: ifsz=80522 idim=200x200 ifmt=gif ofsz=78253 odim=200x200 ofmt=gif ofrm=30
http_x_geo_continent: EU
fastly-stats: io=1
x-pantheon-styx-hostname: styx-fe1-b-5d587d78fd-ct69k
content-length: 78253
x-served-by: cache-chi-kigq8000130-CHI, cache-ams21030-AMS, cache-ams21030-AMS, cache-mxp6972-MXP
server: nginx
x-timer: S1721290911.309407,VS0,VE2
etag: "Nxhc6+NYNokf+oi4tit7qUckgh54LwQ6JJFLiU/ddPg"
vary: Accept
content-type: image/gif
x-styx-req-id: f78894ba-341a-11ef-a5ff-065f8a95e18c
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 28 Jun 2025 00:19:49 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
433 B 39ms
39ms Script
application/javascript 2600:9000:235a:3400:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=websense/forcepoint-2018/202407161702&cb=1721290911293
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:3400:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-version-id: 2XUX04X5QEw0.xFya64khU._sHTRl_Pz
date: Thu, 18 Jul 2024 08:15:53 GMT
via: 1.1 abf16b943a9b4039b87ccdb094d9303e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P9
age: 360
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2
last-modified: Sat, 11 Mar 2023 06:57:46 GMT
server: AmazonS3
etag: "7bc0ee636b3b83484fc3b9348863bd22"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=300
accept-ranges: bytes
x-amz-cf-id: kdwMOdmgTSgayNU7n0g5tLHRgGNnPiF71zvqfpL0VUbB4NqGx80LPA==

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
884 B 228ms
175ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: ac625921-6353-464f-8c01-02fe4a0adddb
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ac625921-6353-464f-8c01-02fe4a0adddb
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-2n8kz
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8a510f859b3abf34-WAW

GET
DATA 200
OK truncated
/ 133 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4cbaa695a841f5471911a40cc4c2140d68b95d9fcaabb3b60e97db200c15b8d

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 / Show response
geolocation-db.com/json/ 144 B
257 B 688ms
608ms XHR
text/html 159.89.102.253
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://geolocation-db.com/json/
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.102.253 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: cd8b481e24df281f60b83478ac0774bd51e19c48851509950532974dabca3130

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 18 Jul 2024 08:21:52 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
content-type: text/html; charset=UTF-8

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
848 B 202ms
181ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 3d6b05e1-4c8a-4c09-94f6-9128f29b8da5
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3d6b05e1-4c8a-4c09-94f6-9128f29b8da5
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-phcmr
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8a510f859b36bf34-WAW

GET
H2 200 / Show response
geolocation-db.com/json/ 144 B
256 B 1089ms
581ms XHR
text/html 159.89.102.253
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://geolocation-db.com/json/
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.102.253 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: cd8b481e24df281f60b83478ac0774bd51e19c48851509950532974dabca3130

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 18 Jul 2024 08:21:52 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
content-type: text/html; charset=UTF-8

GET
H2 200 nr-rum-1.262.0.min.js Show response
js-agent.newrelic.com/ 49 KB
16 KB 144ms
47ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.262.0.min.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a557b02ea64886c022f719706e39e65ad6ba8accd1ab25498e9dd18e6da880d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/
Origin: https://www.forcepoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-version-id: r7yL2WJdLoR2RnA7cy4KmyFp0CcyXjOe
content-encoding: br
via: 1.1 varnish
date: Thu, 18 Jul 2024 08:21:52 GMT
strict-transport-security: max-age=300
x-amz-request-id: 51105SA94RMZ1CB5
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 15610
x-amz-id-2: 0O4Je7Ghd6CK6kdO+gtSn+HQF849aXYqjoUy0RbURvf3gn8Duvbcosh6k/j/Nkr0dAW7opN8vTI=
x-served-by: cache-mxp6977-MXP
last-modified: Wed, 10 Jul 2024 15:59:13 GMT
server: AmazonS3
etag: "8725f7bd03f3c4df3f40d580cf1e5f6c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 117652

GET
H2 200 latest.js Show response
scripts.simpleanalyticscdn.com/ 7 KB
5 KB 194ms
112ms Script
application/javascript 2400:52e0:1e00::1079:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.simpleanalyticscdn.com/latest.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/default/files/advagg_js/js__BsJj-J0DDipBFUM6jWq6jBgbLlOJHFUDm1oaCirTN8s__3ytciCoM4ry2VdZVK_RnAXm_cZfbyZ0Tj9DCUWBKchw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1079 /
Resource Hash: a965bdafdcbdf6a1bc0a04fb81ee6d5fb86e1fde7a2da4e8998ab3bcf467bdb4

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:21:52 GMT
content-encoding: br
cdn-edgestorageid: 1080
cdn-storageserver: DE-680
cdn-cachedat: 04/30/2024 19:00:38
cdn-pullzone: 103822
last-modified: Mon, 10 Jul 2023 03:50:47 GMT
server: BunnyCDN-DE1-1079
cdn-fileserver: 635
cdn-requestpullcode: 200
cdn-proxyver: 1.04
etag: W/"64ab8017-1d5b"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 621ef7c8-45de-46e4-8237-2eca0c3a2d75
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=604800
simple-analytics: true
cdn-requestid: 94756d1c95d542cf1ed40869f9576364
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 favicon.ico
www.forcepoint.com/sites/all/themes/custom/fp/assets/icons/favicon/ 15 KB
990 B 53ms
53ms Other
image/x-icon 2a04:4e42:600::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/icons/favicon/favicon.ico

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::740 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

59a410a623d86c98b190b07e27d0cf4e36455f184fc85cc1a4021aac1bc8a860

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe1-b-778cbf697c-t7qk6
date: Thu, 18 Jul 2024 08:21:52 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
age: 175952
http_x_geo_region: DE-BY
x-cache: HIT, HIT, MISS
http_x_geo_continent: EU
expires: Thu, 17 Jul 2025 07:29:20 GMT
content-length: 606
x-served-by: cache-chi-klot8100165-CHI, cache-mxp6979-MXP, cache-mxp6972-MXP
last-modified: Mon, 15 Jul 2024 20:35:59 GMT
server: nginx
x-timer: S1721290913.516983,VS0,VE5
etag: "6695882f-3aee"
vary: Accept-Encoding
content-type: image/x-icon
x-styx-req-id: 1e260433-4345-11ef-99b2-1aa621e8227a
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 26, 75, 0

POST
H/1.1 200
OK NRJS-922263b7f65c352c48b Show response
bam.nr-data.net/1/ 150 B
701 B 283ms
209ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-922263b7f65c352c48b?a=477262540&v=1.262.0&to=YFEDbUMFXBBXB0RbXlkbNEtYSx0KWABVSh9HXBE%3D&rst=2093&ck=0&s=dbe3cb5a44bb6bb6&ref=https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses&ptid=90933821e77c5d19&ap=1051&be=155&fe=1779&dc=577&at=TBYAGwsfTx4%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1721290910562,%22n%22:0,%22f%22:0,%22dn%22:5,%22dne%22:5,%22c%22:5,%22s%22:52,%22ce%22:101,%22rq%22:101,%22rp%22:155,%22rpe%22:204,%22di%22:697,%22ds%22:705,%22de%22:732,%22dc%22:1932,%22l%22:1932,%22le%22:1934%7D,%22navigation%22:%7B%7D%7D&fp=448&fcp=448
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-rum-1.262.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d178ee57c5d2a506b3799b50fea41d93ed1b786b8249434071bd048f2f376ac

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Thu, 18 Jul 2024 08:21:52 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.forcepoint.com
access-control-expose-headers: Date
Vary: Accept-Encoding
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 8a510f8c9d9b451c-TXL
timing-allow-origin: https://www.forcepoint.com

GET
H/1.1 202
Accepted simple.gif
queue.simpleanalyticscdn.com/ 43 B
410 B 149ms
45ms Image
image/gif 185.182.193.176
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://queue.simpleanalyticscdn.com/simple.gif?version=cdn_latest_11&hostname=www.forcepoint.com&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36&https=true&timezone=Europe%2FBerlin&page_id=4ee7ec51-e17f-4197-9f43-8570217baf6d&session_id=4c99ea46-6d1d-49f7-887c-791dd6b5068c&sri=false&mobile=false&brands=%5B%5D&os_name=&os_version=&path=%2Fblog%2Fx-labs%2Fshadowroot-ransomware-targeting-turkish-businesses&viewport_width=1600&viewport_height=1200&language=de-DE&screen_width=1600&screen_height=1200&unique=true&id=4ee7ec51-e17f-4197-9f43-8570217baf6d&type=pageview&time=1721290912700
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.193.176 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 185-182-193-176.hosted-by-worldstream.net
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://www.forcepoint.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 18 Jul 2024 08:21:52 GMT
Simple-Analytics-Feedback: Thanks for sending this page view!
Simple-Analytics-Location: not_set
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 43
Expires: 0

Verdicts & Comments Add Verdict or Comment

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.hsforms.net/	1970-01-20 22:08:12	Name: __cf_bm Value: 1tGpJZavdIO9_L59a2GZjaR54vyQHDIQycwykggvijc-1721290911-1.0.1.1-YNzcwrEbcnrHGL4GdFHnEo7wYSDrtrYsIbf15HY0gIc6APAxILWT4lemEfNbLIf_DYybpyQNfPMeOWRzTK0oGg
.forcepoint.com/	1970-01-21 06:53:46	Name: utag_main__sn Value: 1
.forcepoint.com/	1970-01-20 22:08:12	Name: utag_main__se Value: 1%3Bexp-session
.forcepoint.com/	1970-01-20 22:08:12	Name: utag_main__ss Value: 1%3Bexp-session
.forcepoint.com/	1970-01-20 22:08:12	Name: utag_main__st Value: 1721292711219%3Bexp-session
.forcepoint.com/	1970-01-20 22:08:12	Name: utag_main_ses_id Value: 1721290911219%3Bexp-session
.forcepoint.com/	1970-01-20 22:08:12	Name: utag_main__pn Value: 1%3Bexp-session
.hsforms.com/	1970-01-20 22:08:12	Name: __cf_bm Value: wPtSfaAql.13emeHy_iOfVIxGuYGp1MdLPelKi6nIUU-1721290911-1.0.1.1-IPSDoEBdOJJkcts56kIhCvSng2bM83Hp9m7YJhfVcPE5HVIcKrqZ20tJS2_tPYkpyEQcdCA_gTEXBqcRtmmAwQ
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: GXSFf1eKWWhZvnuTEBh2BPWuMNdiu1UYMWjdC4UfTfY-1721290911743-0.0.1.1-604800000
.adnxs.com/	1970-01-21 00:17:46	Name: XANDR_PANID Value: A8sQOXY63JLfDWInm1jRoipV7GOIZv13UqXJzRrFxakKiGRWS7MM8ippl1UOiKojyuY5MiGdMqJH4uVaSjVy_bRWCoBuVU3YB0eoZ0XyzMc.
.adnxs.com/	1970-01-21 07:44:10	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 00:17:46	Name: uuid2 Value: 7334164860651945289

19 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_highlight-soft_75_cccccc_1x100.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/help.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/message-24-warning.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/message-24-error.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/menu-expanded.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/tree-bottom.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/menu-collapsed.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/message-24-ok.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/sites/all/libraries/chosen/chosen-sprite@2x.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/throbber-inactive.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/draggable.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/grippie.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_flat_75_ffffff_40x100.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_dadada_1x400.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/tree.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/throbber-active.gif was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_e6e6e6_1x400.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Message: The resource https://www.forcepoint.com/misc/progress.gif was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
security	error	URL: https://scripts.simpleanalyticscdn.com/latest.js(Line 2) Message: Refused to connect to 'https://queue.simpleanalyticscdn.com/append' because it violates the following Content Security Policy directive: "connect-src 'self' .vwo.com .demdex.net .omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net .theadex.com .aumago.com .google-analytics.com .6sc.co .adnxs.com .vidyard.com .6sense.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com api.hubapi.com .hsforms.net .hsforms.com .s3.amazonaws.com .drift.com .clickagy.com .facebook.com .zoominfo.com geolocation-db.com dn.linkedin.oribi.io .hubspot.com .hscollectedforms.net .stackadapt.com .google.com .googletagmanager.com .googleadservices.com google.com .googlesyndication.com .linkedin.com .redditstatic.com .reddit.com .g2crowd.com .quantcount.com".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .fonts.net .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com .ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com .nr-data.net .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com .theadex.com .aumago.com .driftqa.com .scribblecdn.net .esg-global.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .clickagy.com .nimblestory.com .usemessages.com .stackadapt.com .googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com; img-src * data: ; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' .cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net .w55c.net .demandbase.com .company-target.com .gstatic.com .tiqcdn.com .marketo.net .newrelic.com .facebook.net .ads-twitter.com .burly.io .bizographics.com .nr-data.net .licdn.com .tt.omtrdc.net .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com .ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com app.vwo.com .ubembed.com .driftt.com .vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com .adobe.com .consensu.org .bizible.com .theadex.com .aumago.com .zoominfo.com .clickagy.com .redditstatic.com .quantcount.com .g2crowd.com .steelhousemedia.com .scribblecdn.net .esg-global.com .6sc.co .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com .hubapi.com .hsforms.net .hsforms.com geolocation-db.com .drift.com .jquery.com .google.com .hscollectedforms.net .jsdelivr.net .stackadapt.com .googlesyndication.com .simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com .ceros.com .hubspot.com .hubspot.net .demdex.net .libsyn.com .youtube.com; font-src 'self' .google.com .googleadservices.com; connect-src 'self' .vwo.com .demdex.net .omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net .theadex.com .aumago.com .google-analytics.com .6sc.co .adnxs.com .vidyard.com .6sense.com .hs-scripts.com .hs-analytics.net .hsadspixel.net .hs-banner.com api.hubapi.com .hsforms.net .hsforms.com .s3.amazonaws.com .drift.com .clickagy.com .facebook.com .zoominfo.com geolocation-db.com dn.linkedin.oribi.io .hubspot.com .hscollectedforms.net .stackadapt.com .google.com .googletagmanager.com .googleadservices.com google.com .googlesyndication.com .linkedin.com .redditstatic.com .reddit.com .g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

attr.ml-api.io
bam.nr-data.net
cdnjs.cloudflare.com
code.jquery.com
forms-na1.hsforms.com
forms.hsforms.com
geolocation-db.com
js-agent.newrelic.com
js.hsforms.net
queue.simpleanalyticscdn.com
s.ml-attr.com
scripts.simpleanalyticscdn.com
secure.adnxs.com
tags.tiqcdn.com
www.forcepoint.com
103.43.90.117
104.17.25.14
104.18.141.119
104.18.80.204
104.19.175.188
159.89.102.253
162.247.241.14
185.182.193.176
2400:52e0:1e00::1079:1
2600:9000:206f:fe00:5:7a81:86c0:93a1
2600:9000:235a:3400:7:2bfb:7c00:93a1
2602:816:5001::39
2a04:4e42:600::649
2a04:4e42:600::740
68.67.153.60
033ea4cefced423a11d0cc62afb56c3b09c16913abe8a891fc578b2f2327a101
04b512735003d45868136e8382b0835e32e8aa2bbe73634cb6a9059bde1f50de
0af941ad21ab4dc704f04bdf8d21825869cfe27eb61b3a37e295f70697c48c88
0eb42d32c51e79e9d48a5694328c0ce8889f58a2c25bf13f239a8d818226a96a
0ec291adef932c1e26510f560daef99d2d26b96331cbfd2f29fe234eaf2dddae
10aa7853a3babe185246e6f1fad2c5800902a268dd63b66c53b96889ee5188f3
13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b
148a74b0921ad78021d716e8032ede1cdaf7ed7279cefd7d2acbe906add12a68
195211df418c32079abb41bb0ebd2ea3aace287509a9c49702d80f1350313527
1a5c0fb755eabd84fa9ee65115561abfc934cb67631d8392acc299bed349942d
1dcfd61bd8bfca49b2432c76f3d20e19d3244eaf766dea8055283cb623812d8a
1f81387d932ab97c0ddff8edfc8e1ca4e37201b3cfb5d3911bc25a04e4087ae7
212f36154bde29fb1769244168fa4f40e77315fffa6ae42fff232062f8ed7a0a
23101a57da5bd64dde755399a7f34a1c69bb4addcdfe003a9aa99d3d022483ed
24dd593caf98fe7183e48e16a5a827ab4eb1a734a9821b497689127e68774db1
2528d731c4e61e67f78982f202d1de7e6f7a234117b4d9c98325c27e33c6e1d3
26e256bfa2011f9fbbe0e81f2515c98b94b7ee7696a82f380cb7e7c8361e04a4
29aebe811bb2f84bd90cfdee7ffc4c4af62bb5d871fd683f8a85bf0852ce9163
2a4693f2cfab06c8f82a71e57d82363c57e3b93597ea2a9c08c2bb08f83839f0
2a7b733b2f19d538893df08b2c194aef1201dbad6ee2ddafc5bcd34cbb482d6b
2caf6812d133b2fc835155902536bee390fd4dca3f8d6cc7e62f7081e27debf6
2d178ee57c5d2a506b3799b50fea41d93ed1b786b8249434071bd048f2f376ac
2da781a6191588a46eeb8e47e2d5c4fd2d49a2eceeb1e6e061dbac289e63dc7c
2db23bd96dca0757b0f0d309acb62fe766c08348c86c195ed79658f7f7b456c3
3058f7c617c39b1a94849fa7223c2f756437af3f215155d37c2a29c36848e28d
3180fea88eaa47e87effdffd92cc7f52249a701909b6b617b2d0c55b7a0e7c98
33b9732e0e2aa2683522382286b86715ec85f147959f352137f49a1d4feb79a0
33df7d1430b49b83528e5df930e1da6d9bf492fb32b37ff2b9fd4d97834a0abd
3f3a06c93db350a7a9d3616a3dbbd6c252e702ade48978256c8a125fc2981d2d
42793f24dc3fddca04cc84a6991f0fc73c25498d023b07d488dd5e4238ed9b0c
4577c7682212aced0e91a82f5d2e9876a77151bf8f16a8317e8a95fc29c87f8d
483feab2b57e186b9b87d17c0441d26fd342526af75d64c8985a85734b879eb3
4953a30def5d6eb8aa0119f918104b5069d10696ee634288c068accf06bb44e6
496d9a19dda325d9587f3729b5a16b1262f91a6b237e1aa5d54ed90e087c35e3
4c8537e1208918b04f3b7970b4e53d6c91b138b7b8325b469a4a5e84ced6ce2a
4d58ffb4437135b1a4f7b8cbf01321ea85fe244416aed493ea942462f3d58c86
4e2a8b16a227605843bcf04d32557fa5f790d17d5fae10db399f3ad6b75cae70
521bfd25b076ada01d23b9d20bca3a3e67840702ca4d43b73d0a496575107e9e
52239b576d3fdb13fa5cec121a5e5ed123560a4ac1310d991f4694bcc5507710
5390daebe4fc263953ae2cd18f060ebb4aaef20d9df443a4d784cc642ed1eaf2
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
59a410a623d86c98b190b07e27d0cf4e36455f184fc85cc1a4021aac1bc8a860
5cfc739598cda856cc20575229f8a5251e8df5b175830fe7886aaef79dfb6886
5f4e0577cb49e1130ec7098698e3556c0a2b7f33d02ec5789ee09b116e403f7e
5f8d1adf76eaaf2f3592e5a5633ef8722740af2424b1737d85c1d9581588884f
6116382548abaad3d6133a60e2dc187d88dfa1ed07d981311c0bbcfaee05cd49
61deedef5519831c5ba93b5ea4ccbe1d3a6a544c37709704271d05871caf1a02
634b615987ef6bc5cf11ff7eb78673aebf61e436dc7a56de0f4b4aa543ccb577
6676353d7029b44112419ac26efd665e84021eb418ccf05a1e1f04d0ba46bd53
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
67138202cdb85739d98743e8226b60fbef18366ce3da88902bee16dacd0f0959
6806cdcdd3c7f06950968eeebc5ed11dc261adde18cfefd541532fcf5e59ddff
68cb94151d86903ee4b3a5088e233b408a81a7faf9bb97d1172d8e3e6a83f868
69a02b48768b8f413fe8470c65b4232a39dc3d68350f1246da8721e92ac7e75d
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
712e59da51ddbfc83c263cc8c2b6a404d9f3ec89e830f11220db390c5a410456
735b78ae1f09b1d02ee92b5ad319a189d50d10ecbec4ddd12201885dde3f4945
74d6ee660ac8d18d3940eefac6e8c0ff029ecc0f4a4799ada5d6088fe9abfbc8
76aefb325bdfaf3c67be7591a00c96105ffa1a3eda8cfc16d6d5e1affa8e3f95
76fea4cad87ffbee4d6c0d29a46382913e4a8c56ed7881d8556f684a174d6824
77bfa66bf799ef1d5be3e464795aaca2f9a0587c1616b9671f7383623474f455
7a06dd94021db644db9732192dd8c6b062b80d3f99488e35ce495e82f0ccf961
7dfeb329f73421a0c80e8a067d3e1d67c916c84746f94cb9826c06bc58516d1f
7e9433a7e4538237be585d3d84e1603595879c286be61e26dd3e628e3fd5e206
8048b6a47a7795c53151c7d28f992a190da59cfa9416a171a03652359a964f2a
8117b5d7ba159bfb0cf341d96a566b4b06c466a0038eca2273a8533b1536e019
83fb1040f8f7dc9b42904b8ea0507b1fec248e2ffa8a0ad32d8f00357e9a01f3
8709e66f3192aac47989a4f2c826afc3062b52de3cd792115cba3314c05656c6
8892ffd9b6812e96fca28cf2b24a4a1e25711631d73141353f1ec57fcaf523b8
90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158
91997f03543fdd296c85e60feede1e3df0e950aca03698583ff2870869a2dc0b
942ba1b657ab7477bc603f7852ff551aa393de40d1bab2dee01c8ad36d538a2a
9528ca634fecad433d044ddd3e6f9ce1f068d5d932dafdbb19d8e6daea1968bd
98bee51ffbb032cfea01030abf23549c6d762f6d8283599e52bfb089f01b8742
9b3c52df9ce6473c11ee62f85cd48a7ff2b24ad8543ed415fec5124605a987f3
9cc77ec166565cf138f088e29b263d7de28ebff89c6ac6ac7b3226b8c2c45f33
9e815610f978cad8bc6a72832b206c68e17bf6799cd0c937b2b3c30014243f73
a0d9d290c9928affdd7f2816a574b367cbd6aca7ff1ba7b14b3391330d6f1995
a167f660daaa2f0abba7204685eb46f7127b490d936f10747a2f8c5daba26b83
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a4cbaa695a841f5471911a40cc4c2140d68b95d9fcaabb3b60e97db200c15b8d
a557b02ea64886c022f719706e39e65ad6ba8accd1ab25498e9dd18e6da880d7
a77f86a159e012d113c05ef105506b685a244ffdfa2aa168ca08777af4ff3a64
a965bdafdcbdf6a1bc0a04fb81ee6d5fb86e1fde7a2da4e8998ab3bcf467bdb4
ac12f243172f3c8376a67f24942257093fd70d0c10212a58bf8df60f372be24e
ac549b887c22d68ffc9963e419cb31015a2305200948d06f3ca24c67b1986d81
af60288a11ae9864cdd707a9c6e13463359d5ffb6755bf9035a878f18b8758f9
b2da29ed5ab13ba88c22a51b412428640f8b495c40e0225d712d16eb6ea8351e
b4229c88ccc9ec00268d759c808bb5fc56a62479618d140eebd7948299a1544b
b48a895c0170a7310b29b01897fcf1954b43655748ce98037abae38562754a29
b59117aaaa77098f07b611fff721f582ad56daaf3a460dc4161c29172632918d
b5c2800c52737f3425d0e434c93f9412da5e0491282c8d3d53b4d707202b8cef
b9b8fe9d0d7983bd3dc05016caf09d5028c4525e9beba05ecf0ed85bd0f3f86a
b9c823db89be14289e3b0585970e3d91c3313ec9f82d13c9cb24d90820efc699
bd74c29617fed2dbd2f684dce7eebb659567ce0ae06be3418615ebe846a1bf5b
bfcc07136dc1faaee36973ca4858e530e403f2f41948fbdc47f0c3c399308db6
c0c810909068da447ca522f9770490722119d254f18905ae37e5e4a45e2c346c
c1524c7035a894f370d34f2d57704873a3978adef91d97978e3598515762eace
c16c2e899bbe232a64c1bd49e4312a7f9ea738cb2cb17058e63477a71b246fa7
c181c648e71e1f94dc9f3aa0aced539df9790bc1aa92494d7fe7b17c274767bf
c2a54667fcd4151ef9a27b18f84f24c0b884fe593302ca1eb1210d114f4bd06b
c309dbbe647bbf8904cf5cf33833f02fdc6e00c6bb5a95cdf9f29fac4e662207
c3af792cf17fc9da7b301e6ec8a24dcec9e7b4d3ef83622c2417329f658e8848
c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0
c654220d555e70fb63334836085ed53e9a9d2982e79824664fba6d89e6dc490e
c6a4f005d0158d27d475991d4606ec4141f42917cc68835019d819c583957710
c712b85f4d57c41bb049c80303067da9790aa76b32a41b422174bd507695f444
c7397ae13ad9d12bf4ce9100756dd8703b515ac4381bdd33638e22c787c0fb39
cd8b481e24df281f60b83478ac0774bd51e19c48851509950532974dabca3130
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
d88c03f60c9b0c3b3a4a929ad268b6078dda88e59ea5c98eeb16f031ffb0d9e0
db7de84263a6dfe6f7a674f478b4a6c5a97d7de7e0c7f52a12a5dedfb201004f
dd329c644951f3c041200e8279e3c90063ac5b5c8861fe253fca48df7dd8b99c
de0c91884c0f70a3c8ab477b2637d9c9417fc74eb663bbe6eace7836e8b38fc3
defd01b0db74c62e4efe18ef38e5ec968f2b8c2cf51ab6b14f12e1ad250eec84
e1652e3fbc6cef41f94897b295b6b1f57fa4901a3727e4c9ecb2911614531d0f
e25fa89bb49f7875384fe86ddb39c8c0a966f7aff529e4aa1e761efe8909fdad
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e68e4b1057684aa14f6d44055bd77c6ee8170be28010b94e0278e2d05775973c
e6bb0467284ad6bf4b716def881b4ecb16751807121ba3e2fcca55a33c850dc0
ea07860293f07c2308249b8655e8ef4d5c1569accaec066614e9e49190103cbb
eb06d9c1faf512de924b0840e5ff2cea13ea5154e84b9a2edb23c3ee94602bd7
ec5d5e9a8573943abc88da8c47fead83a877d69e64c69b339dbc9a893da055c9
ece4490c33a7069c08a0e696be3541870684db90df7dbb70205a99dc57973eac
ee27e3cdc69e172aac4b82b3f20d30a2e9b8fc56e7154475292f0ce338b8a5a5
ee3184f88b136b6ad521ec8d57fcf138b0c78172ee82e5d8773998bebac6486d
f443007354af04e5d9f0aea2ce21303442752753ce63ab035a6c76d4f06d5d52
f4cbc6a70cd3d48475ddbb975d3831d02e4158a76fcdb997891baa497ea31241
f66578f61dcd2d00bb8b7a0c5a7a02d39871c2e7c4615826c4e3a6a879a1a66b
f7d4d17ef4f0103008287290e9dd7bb35be1d08f0f8bc315033d13d0cfa6a6a5
f8c79df7183de5a0687fc40c5a9b1034d074e603d558c05a5311c7f91d9ccfe1
fad8df5718762444a80e745fd3b375ecfee298b37c480de5134b8a0ed05bc7a5
fd08b09bb992ad9d8eb1fa512716a782939ee1df7c7b10ebecef57bc7b023626
fe9132775150b13960723fdffd15ef8bb7f07d120787874114ac9e3d4f303f46
ff35e1bb0b3e1cb03aa7eab3fb0f74381ec3fd6fcff85d8c4f6be72abae116a0
ff79200e9d0486ad1207f01f3c5918eea0771ded9b1681694da8caaae4c74c1a

www.forcepoint.com Open in urlscan Pro 2a04:4e42:600::740 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

120 Requests

99 %HTTPS

40 %IPv6

13 Domains

15 Subdomains

14 IPs

5 Countries

2593 kBTransfer

6027 kBSize

12 Cookies

8 Outgoing links

Redirected requests

120 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 21 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.forcepoint.com Open in urlscan Pro
2a04:4e42:600::740 Public Scan

Screenshot
Live screenshot

Full Image

120
Requests

99 %
HTTPS

40 %
IPv6

13
Domains

15
Subdomains

14
IPs

5
Countries

2593 kB
Transfer

6027 kB
Size

12
Cookies

120 HTTP transactions
21 data transactions