www.forcepoint.com Open in urlscan Pro
2a04:4e42::740 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.forcepoint.com/blog/security-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Effective URL:
https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Submission: On October 26 via api (October 26th 2020, 6:19:43 pm UTC) from US

Summary HTTP 142 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 41 IPs in 7 countries across 38 domains to perform 142 HTTP transactions. The main IP is 2a04:4e42::740, located in Ascension Island and belongs to FASTLY, US. The main domain is www.forcepoint.com.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on January 24th 2020. Valid for: 2 years.

This is the only time www.forcepoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4 62	2a04:4e42::740 2a04:4e42::740	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.111.215.136 104.111.215.136	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2600:9000:20d... 2600:9000:20d7:5c00:3:c04e:c780:93a1	16509 (AMAZON-02) (AMAZON-02)
4	151.101.112.193 151.101.112.193	54113 (FASTLY) (FASTLY)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.33.220.145 185.33.220.145	29990 (ASN-APPNEX) (ASN-APPNEX)
1	99.86.2.95 99.86.2.95	16509 (AMAZON-02) (AMAZON-02)
6	34.96.102.137 34.96.102.137	15169 (GOOGLE) (GOOGLE)
1	143.204.208.228 143.204.208.228	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20d... 2600:9000:20d7:e800:c:a9b7:ddc0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	18.185.151.20 18.185.151.20	16509 (AMAZON-02) (AMAZON-02)
1 3	3.248.78.233 3.248.78.233	16509 (AMAZON-02) (AMAZON-02)
5	68.232.35.12 68.232.35.12	15133 (EDGECAST) (EDGECAST)
3	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
2	104.109.95.62 104.109.95.62	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:10c... 2a02:26f0:10c:582::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.113.131 151.101.113.131	54113 (FASTLY) (FASTLY)
2	65.9.190.46 65.9.190.46	16509 (AMAZON-02) (AMAZON-02)
1 1	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
1 5	95.101.184.154 95.101.184.154	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 5	89.163.159.104 89.163.159.104	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1	2606:4700::68... 2606:4700::6810:a852	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 6	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
3 3	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
1	52.30.191.169 52.30.191.169	16509 (AMAZON-02) (AMAZON-02)
2	35.181.18.61 35.181.18.61	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:4001:803::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	65.9.190.35 65.9.190.35	16509 (AMAZON-02) (AMAZON-02)
2	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1 2	54.171.28.113 54.171.28.113	16509 (AMAZON-02) (AMAZON-02)
5	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	18.196.95.178 18.196.95.178	16509 (AMAZON-02) (AMAZON-02)
1	52.0.105.155 52.0.105.155	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.114.110 151.101.114.110	54113 (FASTLY) (FASTLY)
2	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
2	162.247.242.20 162.247.242.20	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
142	41

62 2a04:4e42::740 (Ascension Island) 4 redirects

ASN54113 (FASTLY, US)

www.forcepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.215.136 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-136.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:20d7:5c00:3:c04e:c780:93a1 (United States)

ASN16509 (AMAZON-02, US)

ws.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.220.145 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.2.95 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-2-95.fra6.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.96.102.137 (United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.208.228 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-208-228.fra53.r.cloudfront.net

d5phz18u4wuww.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20d7:e800:c:a9b7:ddc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.sharethis.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.185.151.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-151-20.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.248.78.233 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-78-233.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 68.232.35.12 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.95.62 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-95-62.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:582::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.113.131 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.190.46 (Seattle, United States)

ASN16509 (AMAZON-02, US)

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:234:59:254c:406:2366:268c (United States) 1 redirects

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 95.101.184.154 (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)
PTR: a95-101-184-154.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 89.163.159.104 (Cloppenburg, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

dmp.theadex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a05:f500:11:101::b93f:9005 (Ireland) 3 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:22::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.30.191.169 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-191-169.eu-west-1.compute.amazonaws.com

websenseinc.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.181.18.61 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

analyticsssl.forcepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.190.35 (Seattle, United States)

ASN16509 (AMAZON-02, US)

assets.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.171.28.113 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-28-113.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

018-nkf-008.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.95.178 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.0.105.155 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

nextroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.247.242.20 (San Francisco, United States)

ASN23467 (NEWRELIC-AS-1, US)
PTR: bam-8.nr-data.net

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	forcepoint.com 4 redirects www.forcepoint.com analyticsssl.forcepoint.com	1 MB
9	linkedin.com 6 redirects px.ads.linkedin.com www.linkedin.com	5 KB
6	adroll.com 1 redirects s.adroll.com d.adroll.com	70 KB
6	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com	101 KB
6	sharethis.com ws.sharethis.com l.sharethis.com	40 KB
5	facebook.com www.facebook.com	704 B
5	theadex.com 1 redirects dmp.theadex.com	15 KB
4	bizible.com cdn.bizible.com	34 KB
4	demdex.net 1 redirects dpm.demdex.net websenseinc.demdex.net	3 KB
4	imgur.com i.imgur.com	59 KB
3	facebook.net connect.facebook.net	160 KB
3	twitter.com 1 redirects platform.twitter.com analytics.twitter.com	1 KB
3	ubembed.com 6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com assets.ubembed.com 6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com 6634a5cdf59e4bb3a8f70dcd111da346.events.ubembed.com Failed	48 KB
3	google-analytics.com www.google-analytics.com	20 KB
3	tiqcdn.com tags.tiqcdn.com	111 KB
2	nr-data.net bam.nr-data.net	459 B
2	t.co t.co	572 B
2	ads-twitter.com static.ads-twitter.com	4 KB
2	driftt.com js.driftt.com	45 KB
2	licdn.com snap.licdn.com	3 KB
2	marketo.net munchkin.marketo.net	6 KB
2	consensu.org 1 redirects c.sharethis.mgr.consensu.org d.adroll.mgr.consensu.org	137 B
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	googleapis.com ajax.googleapis.com	92 KB
1	newrelic.com js-agent.newrelic.com	11 KB
1	nextroll.com nextroll.com	2 KB
1	mktoresp.com 018-nkf-008.mktoresp.com	311 B
1	bizibly.com cdn.bizibly.com	204 B
1	google.de www.google.de	106 B
1	google.com www.google.com	106 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	doubleclick.net stats.g.doubleclick.net	90 B
1	zoominfo.com ws.zoominfo.com	724 B
1	googletagmanager.com www.googletagmanager.com	37 KB
1	cloudfront.net d5phz18u4wuww.cloudfront.net	56 KB
1	ml-api.io attr.ml-api.io	484 B
1	ml-attr.com 1 redirects s.ml-attr.com	283 B
1	cloudflare.com cdnjs.cloudflare.com	2 KB
142	38

	Domain	Requested by
62	www.forcepoint.com	4 redirects www.forcepoint.com cdn.bizible.com
6	px.ads.linkedin.com	3 redirects www.forcepoint.com
6	dev.visualwebsiteoptimizer.com	tags.tiqcdn.com dev.visualwebsiteoptimizer.com www.forcepoint.com d5phz18u4wuww.cloudfront.net
5	www.facebook.com	www.forcepoint.com
5	dmp.theadex.com	1 redirects tags.tiqcdn.com www.forcepoint.com dmp.theadex.com
5	s.adroll.com	1 redirects tags.tiqcdn.com www.forcepoint.com s.adroll.com
4	cdn.bizible.com	tags.tiqcdn.com www.forcepoint.com cdn.bizible.com
4	i.imgur.com	www.forcepoint.com
4	ws.sharethis.com	www.forcepoint.com ws.sharethis.com
3	www.linkedin.com	3 redirects
3	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
3	www.google-analytics.com	tags.tiqcdn.com www.google-analytics.com www.forcepoint.com
3	dpm.demdex.net	1 redirects www.forcepoint.com
3	tags.tiqcdn.com	www.forcepoint.com tags.tiqcdn.com
2	bam.nr-data.net	js-agent.newrelic.com cdn.bizible.com
2	analytics.twitter.com	platform.twitter.com
2	t.co	www.forcepoint.com
2	analyticsssl.forcepoint.com	tags.tiqcdn.com www.forcepoint.com
2	static.ads-twitter.com	www.forcepoint.com tags.tiqcdn.com
2	js.driftt.com	tags.tiqcdn.com js.driftt.com
2	snap.licdn.com	tags.tiqcdn.com snap.licdn.com
2	munchkin.marketo.net	tags.tiqcdn.com www.forcepoint.com
2	l.sharethis.com	ws.sharethis.com www.forcepoint.com
2	secure.adnxs.com	2 redirects
2	ajax.googleapis.com	www.forcepoint.com
1	js-agent.newrelic.com	www.forcepoint.com
1	nextroll.com	www.forcepoint.com
1	6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com	assets.ubembed.com
1	018-nkf-008.mktoresp.com	cdn.bizible.com
1	d.adroll.com	www.forcepoint.com
1	d.adroll.mgr.consensu.org	1 redirects
1	assets.ubembed.com	6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com
1	cdn.bizibly.com	www.forcepoint.com
1	www.google.de	www.forcepoint.com
1	www.google.com	www.forcepoint.com
1	cm.everesttech.net	1 redirects
1	websenseinc.demdex.net	tags.tiqcdn.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	ws.zoominfo.com	tags.tiqcdn.com
1	www.googletagmanager.com	tags.tiqcdn.com
1	platform.twitter.com	1 redirects
1	6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com	tags.tiqcdn.com
1	c.sharethis.mgr.consensu.org	ws.sharethis.com
1	d5phz18u4wuww.cloudfront.net	tags.tiqcdn.com
1	attr.ml-api.io	www.forcepoint.com
1	s.ml-attr.com	1 redirects
1	cdnjs.cloudflare.com	www.forcepoint.com
0	6634a5cdf59e4bb3a8f70dcd111da346.events.ubembed.com Failed	cdn.bizible.com
142	48

This site contains links to these domains. Also see Links.

Domain
partners.forcepoint.com
support.forcepoint.com
learn.forcepoint.com
www.cra-arc.gc.ca
go.forcepoint.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
*.forcepoint.com Sectigo RSA Organization Validation Secure Server CA	`2020-01-24` - `2022-01-23`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2020-03-16` - `2021-06-15`	a year	crt.sh
sharethis.com Amazon	`2020-08-17` - `2021-09-16`	a year	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2020-01-15` - `2022-03-16`	2 years	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2020-06-19` - `2022-07-06`	2 years	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
sharethis.mgr.consensu.org Amazon	`2020-05-05` - `2021-06-05`	a year	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
io.bizible.com DigiCert SHA2 Secure Server CA	`2020-10-07` - `2021-11-08`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
z.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-09-02` - `2021-04-23`	8 months	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
*.theadex.com GeoTrust RSA CA 2018	`2019-10-11` - `2021-10-10`	2 years	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
analyticsssl.forcepoint.com DigiCert SHA2 High Assurance Server CA	`2020-08-10` - `2021-11-17`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
assets.ubembed.com Amazon	`2020-04-04` - `2021-05-04`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-02-18` - `2021-02-06`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
*.pages.ubembed.com Sectigo RSA Domain Validation Secure Server CA	`2020-03-09` - `2022-03-22`	2 years	crt.sh
nextroll.com Let's Encrypt Authority X3	`2020-09-20` - `2020-12-19`	3 months	crt.sh
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-23` - `2021-05-07`	6 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-05` - `2022-02-08`	2 years	crt.sh

This page contains 7 frames:

Primary Page: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Frame ID: D3551E75FEE11ACD1555AEFE199092A0
Requests: 157 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/portal-v2.html
Frame ID: 6575A3531BF3DEA840FEC17EFEAB1485
Requests: 1 HTTP requests in this frame

Frame: https://websenseinc.demdex.net/dest5.html?d_nsid=0
Frame ID: 2C2A1685D346DD465FDFF0DBC2F4E135
Requests: 1 HTTP requests in this frame

Frame: https://dmp.theadex.com/r/506/3014/?c=4241747781479856255&adex_consent=1&adex_consent_origin=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&adex_consent_checked=1603736366
Frame ID: 34CFE18B42CC8C6039885CAC6DDC8168
Requests: 1 HTTP requests in this frame

Frame: https://6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com/c2ee68b3-633d-4717-b374-6c081963ff9f/e.html?closedAt=0
Frame ID: 6B66858F1335A7C6CED1A8707800FED3
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: C4642AEBE0E550A0EB090B3511C359CF
Requests: 1 HTTP requests in this frame

Frame: https://ws.sharethis.com/secure5x/index.html
Frame ID: AF809EF78C6DCBCFE683621E9363C4E2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.forcepoint.com/blog/security-labs/zeus-delivered-deloader-defraud-customers-canadian-banks HTTP 301
https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks Page URL

Detected technologies

Drupal (CMS) Expand

Overall confidence: 100%
Detected patterns

headers expires /19 Nov 1978/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers expires /19 Nov 1978/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /varnish(?: $Varnish\/([\d.]+)$)?/i

Page Statistics

142
Requests

99 %
HTTPS

38 %
IPv6

38
Domains

48
Subdomains

41
IPs

7
Countries

2158 kB
Transfer

6065 kB
Size

32
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://partners.forcepoint.com/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://support.forcepoint.com/
Title: Support Login

Search URL Search Domain Scan URL

URL: https://learn.forcepoint.com/
Title: Training

Search URL Search Domain Scan URL

URL: https://support.forcepoint.com/TechnicalSupportPrograms
Title: Enterprise Support Options

Search URL Search Domain Scan URL

URL: http://www.cra-arc.gc.ca/scrty/frdprvntn/menu-eng.html
Title: additional information

Search URL Search Domain Scan URL

URL: https://go.forcepoint.com/CommunicationPreferenceCenter.html
Title: Manage Subscriptions

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/forcepoint?trk=fc_badge
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/forcepointsec
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ForcepointLLC
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC4MbQECdktvwewRlAFwT_-w
Title: YouTube

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.forcepoint.com/blog/security-labs/zeus-delivered-deloader-defraud-customers-canadian-banks HTTP 301
https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.forcepoint.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=www.forcepoint.com&pId=9212681960631425886

Request Chain 87

https://www.forcepoint.com/ajax/eu-cookie-compliance/ HTTP 301
https://www.forcepoint.com/ajax/eu-cookie-compliance

Request Chain 97

https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=8DC067C25245AFA80A490D4C%40AdobeOrg&d_nsid=0&ts=1603736366267 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=8DC067C25245AFA80A490D4C%40AdobeOrg&d_nsid=0&ts=1603736366267

Request Chain 104

https://platform.twitter.com/oct.js HTTP 301
https://static.ads-twitter.com/oct.js

Request Chain 112

https://px.ads.linkedin.com/collect/?pid=2141257&fmt=gif&_rnd=0.5842887408065405 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D2141257%26fmt%3Dgif%26_rnd%3D0.5842887408065405%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?pid=2141257&fmt=gif&_rnd=0.5842887408065405&liSync=true

Request Chain 113

https://px.ads.linkedin.com/collect/?pid=1681282&fmt=gif&_rnd=0.6692908053642495 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D1681282%26fmt%3Dgif%26_rnd%3D0.6692908053642495%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?pid=1681282&fmt=gif&_rnd=0.6692908053642495&liSync=true

Request Chain 121

https://cm.everesttech.net/cm/dd?d_uuid=04666446448492738122807294436445648538 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5cTLgAAB59kBlL0

Request Chain 130

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=258729&time=1603736366408&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D258729%26time%3D1603736366408%26url%3Dhttps%253A%252F%252Fwww.forcepoint.com%252Fblog%252Fx-labs%252Fzeus-delivered-deloader-defraud-customers-canadian-banks%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=258729&time=1603736366408&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&liSync=true

Request Chain 131

https://s.adroll.com/j/exp/2GRHXEZSJNFRTPMEC6ZM2B/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 133

https://d.adroll.mgr.consensu.org/consent/iabcheck/2GRHXEZSJNFRTPMEC6ZM2B?_s=2a805339134001a315e571255f251d1e&_b=2 HTTP 302
https://d.adroll.com/consent/check/2GRHXEZSJNFRTPMEC6ZM2B/?_s=2a805339134001a315e571255f251d1e&_b=2

Request Chain 135

https://dmp.theadex.com/trace.js?adex_consent=1 HTTP 303
https://dmp.theadex.com/trace.js?adex_consent=1&axd_sc=4241747781479856255

Request Chain 140

https://www.forcepoint.com/js/forms2/css/forms2.css HTTP 301
https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css

Request Chain 141

https://www.forcepoint.com/js/forms2/css/forms2-theme-simple.css HTTP 301
https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css

142 HTTP transactions
21 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request zeus-delivered-deloader-defraud-customers-canadian-banks Show response
www.forcepoint.com/blog/x-labs/
Redirect Chain

https://www.forcepoint.com/blog/security-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

87 KB
26 KB

2684ms
2684ms

Document
text/html

2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d0b790fc60c934512442fccae90a7ad9f74471945f9d480f5f04736e41813f9a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: 'unsafe-inline' 'unsafe-eval' .fonts.net analyticsssl.forcepoint.com .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com static.ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com bam.nr-data.net maps.gstatic.com .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com dmp.theadex.com tag.aumago.com; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' pixel.cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net tags.w55c.net .demandbase.com .company-target.com maps.gstatic.com tags.tiqcdn.com munchkin.marketo.net .newrelic.com connect.facebook.net static.ads-twitter.com a.burly.io sjs.bizographics.com bam.nr-data.net snap.licdn.com https://websense.tt.omtrdc.net/m2/websense/mbox/json .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com attr.ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com app.vwo.com .js.ubembed.com assets.ubembed.com js.driftt.com cdn.vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com https://activitymap.adobe.com/sc15/activitymap/index.js .consensu.org .bizible.com dmp.theadex.com tag.aumago.com ws.zoominfo.com; img-src data: ; connect-src 'self' app.vwo.com dpm.demdex.net websense.tt.omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net dmp.theadex.com tag.aumago.com google-analytics.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.forcepoint.com
:scheme: https
:path: /blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: public, max-age=1800
content-encoding: gzip
content-language: en
content-security-policy: default-src 'self' data: 'unsafe-inline' 'unsafe-eval' *.fonts.net analyticsssl.forcepoint.com *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com static.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com bam.nr-data.net maps.gstatic.com *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com dmp.theadex.com tag.aumago.com; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' pixel.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net tags.w55c.net *.demandbase.com *.company-target.com maps.gstatic.com tags.tiqcdn.com munchkin.marketo.net *.newrelic.com connect.facebook.net static.ads-twitter.com a.burly.io sjs.bizographics.com bam.nr-data.net snap.licdn.com https://websense.tt.omtrdc.net/m2/websense/mbox/json *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com attr.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com app.vwo.com *.js.ubembed.com assets.ubembed.com js.driftt.com cdn.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com https://activitymap.adobe.com/sc15/activitymap/index.js *.consensu.org *.bizible.com dmp.theadex.com tag.aumago.com ws.zoominfo.com; img-src * data: *; connect-src 'self' app.vwo.com dpm.demdex.net websense.tt.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net dmp.theadex.com tag.aumago.com google-analytics.com; report-uri /admin/config/system/seckit/csp-report
content-type: text/html; charset=utf-8
etag: W/"1603736362-0"
expires: Sun, 19 Nov 1978 05:00:00 GMT
from-origin: same, https://analyticsssl.forcepoint.com,https://vidyard.com
last-modified: Mon, 26 Oct 2020 18:19:22 GMT
link: <https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks>; rel="canonical",<https://www.forcepoint.com/node/22181>; rel="shortlink"
server: nginx
strict-transport-security: max-age=18410000
x-content-type-options: nosniff
x-drupal-cache: MISS
x-frame-options: SAMEORIGIN
x-generator: Drupal 7 (http://drupal.org)
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6gnc5
x-styx-req-id: c575c5b8-17b7-11eb-b01e-0601e0c6002c
x-ua-compatible: IE=Edge,chrome=1
age: 0 0 0 0 0
accept-ranges: bytes bytes bytes bytes bytes
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Mon, 26 Oct 2020 18:19:25 GMT
x-served-by: cache-mdw17339-MDW, cache-mdw17324-MDW, cache-fra19163-FRA, cache-fra19153-FRA
x-cache: MISS, MISS, MISS, MISS
x-cache-hits: 0, 0, 0, 0
x-timer: S1603736362.363308,VS0,VE2678
vary: Accept-Encoding, x-geo-country, Cookie, orig-host
content-length: 23399

Redirect headers

status: 301
cache-control: public, max-age=1800
content-type: text/html; charset=UTF-8
etag: "1603736362-0"
expires: Sun, 19 Nov 1978 05:00:00 GMT
last-modified: Mon, 26 Oct 2020 18:19:22 GMT
location: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
server: nginx
x-content-type-options: nosniff
x-drupal-cache: MISS
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6gnc5
x-redirect-id: 48231
x-styx-req-id: c5590083-17b7-11eb-b01e-0601e0c6002c
age: 0 0 0
accept-ranges: bytes bytes bytes
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=300
date: Mon, 26 Oct 2020 18:19:22 GMT
x-served-by: cache-mdw17363-MDW, cache-mdw17337-MDW, cache-fra19176-FRA, cache-fra19153-FRA
x-cache: MISS, MISS, MISS, MISS
x-cache-hits: 0, 0, 0, 0
x-timer: S1603736362.172493,VS0,VE184
vary: x-geo-country, Cookie, orig-host
content-length: 1

GET
H2 200 Hoves_DemiBold.WOFF
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/ 71 KB
72 KB 113ms
111ms Font
font/woff 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/Hoves_DemiBold.WOFF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

95fa06fca5253dd4347dc57fc0cea541dc25d8fa30771904c1d00fa695603dbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://www.forcepoint.com
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "5f91ff2e-11d88"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-2mqj6
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 73096
x-served-by: cache-mdw17372-MDW, cache-mdw17372-MDW, cache-fra19147-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:46 GMT
server: nginx
x-timer: S1603736365.056528,VS0,VE104
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: orig-host
content-type: font/woff
access-control-allow-origin: *
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 64f3a636-14b3-11eb-b605-56226c185009
x-cache-hits: 24, 0, 0, 0

GET
H2 200 Hoves_Medium.WOFF
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/ 70 KB
70 KB 119ms
116ms Font
font/woff 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/Hoves_Medium.WOFF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3a5e17dd26ebd37ea990a2591a24b1bf8da5bf6f42ddb185abcb5b14674a9bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://www.forcepoint.com
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "5f91ff2b-11710"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-2mqj6
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 71440
x-served-by: cache-mdw17383-MDW, cache-mdw17340-MDW, cache-fra19129-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:43 GMT
server: nginx
x-timer: S1603736365.057249,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: orig-host
content-type: font/woff
access-control-allow-origin: *
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 64f3ea00-14b3-11eb-b605-56226c185009
x-cache-hits: 40616, 0, 0, 0

GET
H2 200 Hoves_Regular.WOFF
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/ 68 KB
68 KB 114ms
112ms Font
font/woff 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/Hoves_Regular.WOFF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e29d9249450c34c94e78ea24e50f48a0921d5403c584539c7f841a18952a12f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://www.forcepoint.com
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "5f91ff2b-10ffc"
age: 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 69628
x-served-by: cache-mdw17368-MDW, cache-mdw17376-MDW, cache-fra19144-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:43 GMT
server: nginx
x-timer: S1603736365.057255,VS0,VE104
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: orig-host
content-type: font/woff
access-control-allow-origin: *
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-styx-req-id: 64f4043c-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 40818, 0, 0, 0

GET
H2 200 Hoves_Italic.WOFF
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/ 74 KB
74 KB 118ms
117ms Font
font/woff 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/Hoves_Italic.WOFF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

152d33f581c1bd7b2a423e3e2fa1a2c34817751298e0829bc4154f9e04844baa

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://www.forcepoint.com
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "5f91ff2b-1265c"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-2mqj6
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 75356
x-served-by: cache-mdw17377-MDW, cache-mdw17377-MDW, cache-fra19147-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:43 GMT
server: nginx
x-timer: S1603736365.057234,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: orig-host
content-type: font/woff
access-control-allow-origin: *
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 64f3f9cf-14b3-11eb-b605-56226c185009
x-cache-hits: 1, 0, 0, 0

GET
H2 200 Hoves_Light.WOFF
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/ 69 KB
70 KB 116ms
114ms Font
font/woff 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/Hoves_Light.WOFF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

8d840af08b18a0a99928ebbbb9a0b4263e08631c0177a3c74963c0e9056c3a21

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://www.forcepoint.com
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "5f91ff2b-1158c"
age: 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6j5jb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 71052
x-served-by: cache-mdw17322-MDW, cache-mdw17322-MDW, cache-fra19163-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:43 GMT
server: nginx
x-timer: S1603736365.057219,VS0,VE104
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: orig-host
content-type: font/woff
access-control-allow-origin: *
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 64f48ccc-14b3-11eb-bd65-8a04a199118e
x-cache-hits: 41, 0, 0, 0

GET
H2 200 Hoves_Light_Italic.WOFF
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/ 73 KB
73 KB 111ms
109ms Font
font/woff 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/Hoves_Light_Italic.WOFF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

0cd76c0e7ab206f138acc0c00c8909b344ebeecd07986a950e1b7632eedca1cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://www.forcepoint.com
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "5f91ff2b-123d4"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 74708
x-served-by: cache-mdw17372-MDW, cache-mdw17330-MDW, cache-fra19158-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:43 GMT
server: nginx
x-timer: S1603736365.057229,VS0,VE103
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: orig-host
content-type: font/woff
access-control-allow-origin: *
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 64f42749-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 38090, 0, 0, 0

GET
H2 200 Hoves_ExtraLight.WOFF
www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/ 68 KB
68 KB 118ms
117ms Font
font/woff 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves/Hoves_ExtraLight.WOFF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e52e36134236de5bc2ed14fae433aeb6c3e22964df2ee8645c05acbbbd80bec0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://www.forcepoint.com
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "5f91ff2b-10f6c"
age: 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 69484
x-served-by: cache-mdw17320-MDW, cache-mdw17364-MDW, cache-fra19134-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:43 GMT
server: nginx
x-timer: S1603736365.057183,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: orig-host
content-type: font/woff
access-control-allow-origin: *
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes
x-styx-req-id: 64f40f31-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 39475, 0, 0, 0

GET
H2 200 css_kShW4RPmRstZ3SpIC-ZvVGNFVAi0WEMuCnI0ZkYIaFw.css
www.forcepoint.com/sites/default/files/css/ 6 KB
2 KB 118ms
113ms Stylesheet
text/css 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/css/css_kShW4RPmRstZ3SpIC-ZvVGNFVAi0WEMuCnI0ZkYIaFw.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

912856e113e646cb59dd2a480be66f5463455408b458432e0a7234664608685c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4942-1820"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 2135
x-served-by: cache-mdw17362-MDW, cache-mdw17341-MDW, cache-fra19125-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:26 GMT
server: nginx
x-timer: S1603736365.061803,VS0,VE104
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 64f45135-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 39766, 0, 0, 0

GET
H2 200 css_faNxbZlG8sYJ1IiqfFXoOTUUnOTNzg59gAMKpmO43D0.css
www.forcepoint.com/sites/default/files/css/ 26 KB
6 KB 117ms
112ms Stylesheet
text/css 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/css/css_faNxbZlG8sYJ1IiqfFXoOTUUnOTNzg59gAMKpmO43D0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7da3716d9946f2c609d488aa7c55e83935149ce4cdce0e7d80030aa663b8dc3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4942-68af"
age: 331736, 331736
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6j5jb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 5773
x-served-by: cache-mdw17381-MDW, cache-mdw17364-MDW, cache-fra19157-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:26 GMT
server: nginx
x-timer: S1603736365.062038,VS0,VE102
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-styx-req-id: 64f43fd1-14b3-11eb-bd65-8a04a199118e
x-cache-hits: 39719, 0, 0, 0

GET
H2 200 css_y115L5Knt9_PZomP6LVZexCl8E3ZuDyEhxFAHrwL1fY.css
www.forcepoint.com/sites/default/files/css/ 10 KB
3 KB 122ms
117ms Stylesheet
text/css 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/css/css_y115L5Knt9_PZomP6LVZexCl8E3ZuDyEhxFAHrwL1fY.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cb5d792f92a7b7dfcf66898fe8b5597b10a5f04dd9b83c848711401ebc0bd5f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4943-2697"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6gnc5
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 2908
x-served-by: cache-mdw17370-MDW, cache-mdw17341-MDW, cache-fra19124-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:27 GMT
server: nginx
x-timer: S1603736365.062022,VS0,VE105
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 64f445c0-14b3-11eb-b01e-0601e0c6002c
x-cache-hits: 39944, 0, 0, 0

GET
H2 200 css_5mKCL5DqNGkDcKjfp6XAFnPoMyR8hINMUbZMPbq_WW0.css
www.forcepoint.com/sites/default/files/css/ 13 KB
4 KB 118ms
113ms Stylesheet
text/css 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/css/css_5mKCL5DqNGkDcKjfp6XAFnPoMyR8hINMUbZMPbq_WW0.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e662822f90ea34690370a8dfa7a5c01673e833247c84834c51b64c3dbabf596d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4944-3426"
age: 331728
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 3292
x-served-by: cache-mdw17372-MDW, cache-mdw17361-MDW, cache-fra19120-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:28 GMT
server: nginx
x-timer: S1603736365.062009,VS0,VE104
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:36 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 6988f597-14b3-11eb-a160-e6110f627779
x-cache-hits: 24598, 0, 0, 0

GET
H2 200 css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css
www.forcepoint.com/sites/default/files/css/ 2 MB
281 KB 124ms
119ms Stylesheet
text/css 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5a1a1ccce193736380d92b310e6c721d7d727d3f5a7efca350606428827a489a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f9200d4-19047a"
age: 331736, 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 286937
x-served-by: cache-mdw17339-MDW, cache-mdw17374-MDW, cache-fra19183-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:59:48 GMT
server: nginx
x-timer: S1603736365.062465,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 64f4669a-14b3-11eb-a160-e6110f627779
x-cache-hits: 10233, 0, 0, 0

GET
H2 200 modernizr-custom.js Show response
www.forcepoint.com/sites/all/libraries/modernizr/ 11 KB
5 KB 117ms
113ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/libraries/modernizr/modernizr-custom.js?qimiwj

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c0e0b9f64e6354a2677f8cc7b48c489b4fac6183a86dfedc0f52bb0cc17fce3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff29-2a3d"
age: 331738, 331738, 331738
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 4862
x-served-by: cache-mdw17346-MDW, cache-mdw17376-MDW, cache-fra19128-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:41 GMT
server: nginx
x-timer: S1603736365.062800,VS0,VE103
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:27 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 63d902fe-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 40318, 0, 0, 0

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.2/ 94 KB
33 KB 15ms
10ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 12:40:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20321
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33495
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Oct 2021 12:40:44 GMT

GET
H2 200 js_38VWQ3jjQx0wRFj7gkntZr077GgJoGn5nv3v05IeLLo.js Show response
www.forcepoint.com/sites/default/files/js/ 39 KB
15 KB 116ms
112ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_38VWQ3jjQx0wRFj7gkntZr077GgJoGn5nv3v05IeLLo.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

dfc5564378e3431d304458fb8249ed66bd3bec6809a069f99efdefd3921e2cba

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4945-9a79"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 14902
x-served-by: cache-mdw17331-MDW, cache-mdw17356-MDW, cache-fra19134-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:29 GMT
server: nginx
x-timer: S1603736365.062765,VS0,VE102
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 64f52cc2-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 41011, 0, 0, 0

GET
H2 200 forms2.min.js Show response
www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/ 169 KB
67 KB 124ms
120ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/forms2.min.js?qimiwj

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a793b9a0507f90f79bb2f91d160962842e4b9aeb48e1475438cdae3717e3834e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff2d-2a548"
age: 331738, 331738, 331738, 331738
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 68073
x-served-by: cache-mdw17372-MDW, cache-mdw17330-MDW, cache-fra19122-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:45 GMT
server: nginx
x-timer: S1603736365.062747,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:27 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 63da0cae-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 41462, 0, 0, 0

GET
H2 200 marketo_forms.js Show response
www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/ 11 KB
4 KB 125ms
121ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/marketo_forms.js?qimiwj

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

178c0cef22122f076e0bd80e16ed1cfbcf9bfe317b4c29f63e69fce067b93887

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff31-2ba1"
age: 331738, 331738, 331738
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6j5jb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 3961
x-served-by: cache-mdw17360-MDW, cache-mdw17376-MDW, cache-fra19135-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:49 GMT
server: nginx
x-timer: S1603736365.062731,VS0,VE108
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:27 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes
x-styx-req-id: 63dc47ff-14b3-11eb-bd65-8a04a199118e
x-cache-hits: 41139, 0, 0, 0

GET
H2 200 munchkin.js Show response
www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/ 1 KB
1 KB 124ms
120ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/munchkin.js?qimiwj

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9483d84c3dbce2446506011035e4135b87b44657eed947acd345faa338521004

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff2d-54b"
age: 331738
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 788
x-served-by: cache-mdw17376-MDW, cache-mdw17332-MDW, cache-fra19172-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:45 GMT
server: nginx
x-timer: S1603736365.062722,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:27 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 63daf79b-14b3-11eb-a160-e6110f627779
x-cache-hits: 41128, 0, 0, 0

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.10.2/ 223 KB
59 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.10.2/jquery-ui.min.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16089a42741acc5fd00ab17da92be9458e8f0029fd645f159e582a7ea0f52ec1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 10:35:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 459825
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60637
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Oct 2021 10:35:40 GMT

GET
H2 200 jquery.stickybits.min.js Show response
cdnjs.cloudflare.com/ajax/libs/stickybits/3.6.7/ 5 KB
2 KB 20ms
17ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnjs.cloudflare.com/ajax/libs/stickybits/3.6.7/jquery.stickybits.min.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9bf02c9770b2f6cca2e8995e99c09c07ef6f970d78f11912f924056a3eaa44e3

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 424372
x-via: cfworker/kv
status: 200
content-length: 1734
cf-request-id: 0607bc000500002be9468c7000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:28 GMT
server: cloudflare
etag: "5eb03fdc-1372"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FJH%2BYw7Mpc%2BNiaeZ2whmvlj%2By1HsWX3IK2B%2Fd%2BQs1e7mycLTBkHX4Rsl7OwsUdIJHMjW0WuAiJtfP9ERYjuzvpd%2ForVwFri72MwKABZ9q6ffz8E%2BinTR4%2F3E%2F3rh4B8Bag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5e862f79ac8a2be9-FRA
expires: Sat, 16 Oct 2021 18:19:25 GMT

GET
H2 200 js_mMJvXJMDka1r1UQhghL_vo4efyAllmmTzPN1incU7Ro.js Show response
www.forcepoint.com/sites/default/files/js/ 63 KB
23 KB 117ms
113ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_mMJvXJMDka1r1UQhghL_vo4efyAllmmTzPN1incU7Ro.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

98c26f5c930391ad6bd544218212ffbe8e1e7f2025966993ccf3758a7714ed1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4945-fc97"
age: 331728, 331728, 331728, 331728, 331728
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 23338
x-served-by: cache-mdw17332-MDW, cache-mdw17327-MDW, cache-fra19138-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:29 GMT
server: nginx
x-timer: S1603736365.062712,VS0,VE103
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:36 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 698969ca-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 35321, 0, 0, 0

GET
H2 200 js_EzB6QYg0Tw5QIjuXXUXzevFv9vziFrfj-yJS0W5RRno.js Show response
www.forcepoint.com/sites/default/files/js/ 272 B
518 B 117ms
114ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_EzB6QYg0Tw5QIjuXXUXzevFv9vziFrfj-yJS0W5RRno.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

13307a4188344f0e50223b975d45f37af16ff6fce216b7e3fb2252d16e51467a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4949-110"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 231
x-served-by: cache-mdw17368-MDW, cache-mdw17323-MDW, cache-fra19163-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:33 GMT
server: nginx
x-timer: S1603736365.062703,VS0,VE103
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 64f5420a-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 37564, 0, 0, 0

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/ 1 KB
798 B 406ms
154ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 013ace7c7bd3d1defdf1f0929013e3209ce060859301e5c87cb237220de141e8

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 15:48:48 GMT
server: AkamaiNetStorage
etag: "6a4195445a1a41a141389c25382f4c4a:1603381728.924663"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 572
expires: Mon, 26 Oct 2020 18:24:25 GMT

GET
H2 200 js_nRWJhQOkK2YuIyFM17gOpsF1hZbK6StRUJ1adS9xz2Y.js Show response
www.forcepoint.com/sites/default/files/js/ 21 KB
8 KB 120ms
117ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_nRWJhQOkK2YuIyFM17gOpsF1hZbK6StRUJ1adS9xz2Y.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9d15898503a42b662e23214cd7b80ea6c1758596cae92b51509d5a752f71cf66

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b496a-52e0"
age: 331360
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6j5jb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 7900
x-served-by: cache-mdw17357-MDW, cache-mdw17344-MDW, cache-fra19156-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:11:06 GMT
server: nginx
x-timer: S1603736365.063030,VS0,VE104
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:16:44 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 44d6f00a-14b4-11eb-bd65-8a04a199118e
x-cache-hits: 1501, 0, 0, 0

GET
H2 200 js_jD8OmzLW3peUxYvgwfAf1ymkfU1Muh2j73NmuyglZKE.js Show response
www.forcepoint.com/sites/default/files/js/ 4 KB
2 KB 117ms
114ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_jD8OmzLW3peUxYvgwfAf1ymkfU1Muh2j73NmuyglZKE.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

8c3f0e9b32d6de9794c58be0c1f01fd729a47d4d4cba1da3ef7366bb282564a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f84983b-10ad"
age: 331360, 331360, 331360, 331360
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 1712
x-served-by: cache-mdw17336-MDW, cache-mdw17345-MDW, cache-fra19174-FRA, cache-fra19153-FRA
last-modified: Mon, 12 Oct 2020 17:54:03 GMT
server: nginx
x-timer: S1603736365.063066,VS0,VE103
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:16:44 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 44d76171-14b4-11eb-87e4-8e589cac6792
x-cache-hits: 1680, 0, 0, 0

GET
H2 200 buttons.js Show response
ws.sharethis.com/button/ 58 KB
16 KB 81ms
27ms Script
application/javascript 2600:9000:20d7:5c00:3:c04e:c780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.sharethis.com/button/buttons.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:5c00:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 8275ce62ba23473ad2cf760b9ac237a235261d5d38523c26d32ed4f48d4d2492

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 24 Oct 2020 14:27:52 GMT
content-encoding: gzip
server: nginx/1.16.1
age: 186693
etag: W/"5f80b32e-e725"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=259200
x-amz-cf-pop: ZAG50-C1
x-robots-tag: noindex, nofollow
x-amz-cf-id: fnZe616HeeAQRfsXw8GPdYC27X7Jkz2HSc8zW4keTPSu73IogrkREw==
via: 1.1 38a3f663851a0597e7026100a58b9b39.cloudfront.net (CloudFront)
expires: Tue, 27 Oct 2020 14:27:52 GMT

GET
H2 200 js_3TmJ_qUXQcot-bnUMi2wLTeAmLXcyoNCoCCaeerfiTM.js Show response
www.forcepoint.com/sites/default/files/js/ 27 KB
8 KB 114ms
112ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_3TmJ_qUXQcot-bnUMi2wLTeAmLXcyoNCoCCaeerfiTM.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

dd3989fea51741ca2df9b9d4322db02d378098b5dcca8342a0209a79eadf8933

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4946-6d63"
age: 331736, 331736, 331736, 331736
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-2mqj6
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 7970
x-served-by: cache-mdw17357-MDW, cache-mdw17338-MDW, cache-fra19126-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:10:30 GMT
server: nginx
x-timer: S1603736365.062992,VS0,VE102
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 64f56c09-14b3-11eb-b605-56226c185009
x-cache-hits: 38700, 0, 0, 0

GET
H2 200 js_FJP39RlZcyrYzsj0WyS8EXc2N_dMm_R6GiP2a0fVlbY.js Show response
www.forcepoint.com/sites/default/files/js/ 35 KB
12 KB 123ms
120ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_FJP39RlZcyrYzsj0WyS8EXc2N_dMm_R6GiP2a0fVlbY.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1493f7f51959732ad8cec8f45b24bc11773637f74c9bf47a1a23f66b47d595b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f7f39d8-8dd6"
age: 331728, 331728, 331728
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 12292
x-served-by: cache-mdw17344-MDW, cache-mdw17369-MDW, cache-fra19143-FRA, cache-fra19153-FRA
last-modified: Thu, 08 Oct 2020 16:10:00 GMT
server: nginx
x-timer: S1603736365.062988,VS0,VE107
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:36 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes
x-styx-req-id: 69890e66-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 16734, 0, 0, 0

GET
H2 200 js_xAJanMLuGq65Vk_piRFqgfI-U2jS7W-cCFGD4O32vJM.js Show response
www.forcepoint.com/sites/default/files/js/ 462 B
610 B 121ms
119ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_xAJanMLuGq65Vk_piRFqgfI-U2jS7W-cCFGD4O32vJM.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c4025a9cc2ee1aaeb9564fe989116a81f23e5368d2ed6f9c085183e0edf6bc93

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b49bc-1ce"
age: 331732, 331732
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 305
x-served-by: cache-mdw17324-MDW, cache-mdw17363-MDW, cache-fra19169-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:12:28 GMT
server: nginx
x-timer: S1603736365.063331,VS0,VE105
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:33 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-styx-req-id: 6784e615-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 208, 0, 0, 0

GET
H2 200 forcepoint.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/ 2 KB
1 KB 113ms
112ms Image
image/svg+xml 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/forcepoint.svg

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c7397ae13ad9d12bf4ce9100756dd8703b515ac4381bdd33638e22c787c0fb39

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff3a-6ad"
age: 331732, 331732, 331732
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 783
x-served-by: cache-mdw17347-MDW, cache-mdw17342-MDW, cache-fra19149-FRA, cache-fra19153-FRA
access-control-allow-origin: *
last-modified: Thu, 22 Oct 2020 21:52:58 GMT
server: nginx
x-timer: S1603736365.468137,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:33 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 67854657-14b3-11eb-a160-e6110f627779
x-cache-hits: 38138, 0, 0, 0

GET
H2 200 why_fp_menu_image.jpg
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 13 KB
14 KB 12ms
11ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/why_fp_menu_image.jpg?itok=7PZkDIzY

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5a3a0313429b22b8fd7b067a306c2733e73b8a1e038591f722ad524e9f60ab79

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "y1mjf0jHj5/8cr/KUpS5f44OJyHbzOR7xlO/5djNFzg"
age: 3403934, 3403934
x-pantheon-styx-hostname: styx-fe3-b-5f5d494784-lpw5d
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=15805 idim=396x395 ifmt=jpeg ofsz=13734 odim=396x395 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 13734
x-served-by: cache-mdw17381-MDW, cache-mdw17358-MDW, cache-fra19138-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.601375,VS0,VE6
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 60bf5cf7-f8c2-11ea-993f-2e22ef25110c
expires: Sat, 18 Sep 2021 08:47:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 dup_2.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 938 B
1 KB 13ms
12ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/dup_2.png?itok=n_tCvBod

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9013ff56b3eb7dacea9886c26ddead020a8cd81822f40ead55df95b779941b14

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "Cg/hYh8EOhYRIuxSmJfuxz90saFRXEnbdrCuDE9MlzE"
age: 2352869, 2352869
x-pantheon-styx-hostname: styx-fe3-a-857f974764-5dm8n
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=1737 idim=48x48 ifmt=png ofsz=938 odim=48x48 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 938
x-served-by: cache-mdw17344-MDW, cache-mdw17340-MDW, cache-fra19134-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.611043,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 94320a8f-0251-11eb-be7b-0ab2c53138bd
expires: Thu, 30 Sep 2021 12:44:56 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 dup_3.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 932 B
1 KB 55ms
55ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/dup_3.png?itok=9kqBfQ6p

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

519be4598150ebd07de7df2af974a5928f956f617b4cecb376181f34bf7b1df6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "Co/FPfbd0r1kjwGJZCkhpbc1BNixTH3YoiDBKcCM74A"
age: 2352708
x-pantheon-styx-hostname: styx-fe3-a-857f974764-5dm8n
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=1738 idim=48x48 ifmt=png ofsz=932 odim=48x48 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 932
x-served-by: cache-mdw17369-MDW, cache-mdw17370-MDW, cache-fra19180-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.625051,VS0,VE49
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: f40d1d6a-0251-11eb-be7b-0ab2c53138bd
expires: Thu, 30 Sep 2021 12:47:37 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 ddp.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 788 B
1 KB 56ms
55ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/ddp.png?itok=wITbcMhf

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

88a9f854838d4933c158c0b65f9e855992a05790931fdd5e588f637cb82d07c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "dXjcIrBEEzC28GI2Loui2HixN4eNIAB0TKs71eri02A"
age: 3906086
x-pantheon-styx-hostname: styx-fe3-a-857f974764-zpnn5
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=1645 idim=48x48 ifmt=png ofsz=788 odim=48x48 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 788
x-served-by: cache-mdw17349-MDW, cache-mdw17349-MDW, cache-fra19141-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.681860,VS0,VE50
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 36ca85a4-f431-11ea-a39b-5ad90953acbe
expires: Sun, 12 Sep 2021 13:17:59 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 1146, 1, 0

GET
H2 200 ddp-positive.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 924 B
1 KB 12ms
11ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/ddp-positive.png?itok=VN8WgY8l

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3bf68fd8998873a2885f9a5e2baccf393024fa7ebb9e992aa260dfe542e1aea0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "Xvs4XcPwxa50ZBYesg38NG/X9lABMhkY/I4qnyLSvog"
age: 3905234, 3905234
x-pantheon-styx-hostname: styx-fe3-b-5f5d494784-sd7mq
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=1237 idim=48x48 ifmt=png ofsz=924 odim=48x48 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 924
x-served-by: cache-mdw17378-MDW, cache-mdw17341-MDW, cache-fra19129-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.736187,VS0,VE6
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 3293c086-f433-11ea-a099-824fe7a30f67
expires: Sun, 12 Sep 2021 13:32:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 dep.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 840 B
1 KB 12ms
12ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/dep.png?itok=Pits8bG4

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7da0540e0b536da199335da765f4aa358878f41b295d64fea84e1ee7ae5c73ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "pdavfN5jKtYrjFgMsVztM8PJKTmYNfgbvvkV8igjM34"
age: 3906083
x-pantheon-styx-hostname: styx-fe3-a-857f974764-sxp7b
x-cache: HIT, HIT, HIT, MISS
fastly-io-info: ifsz=1082 idim=48x48 ifmt=png ofsz=840 odim=48x48 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 840
x-served-by: cache-mdw17377-MDW, cache-mdw17342-MDW, cache-fra19148-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.749514,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 388386fe-f431-11ea-aa2e-2e3c83a662d4
expires: Sun, 12 Sep 2021 13:18:02 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 3, 1, 1, 0

GET
H2 200 dep-positive.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 976 B
1 KB 12ms
11ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/dep-positive.png?itok=71ow2RHw

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7c7037514836388334db2f123a214f7ec133481a2d7d128adb62693b5ce9dcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "Xq40KOT666Dw74pppNkkPYaJ/kj8VcWWEaEW0/3IAlk"
age: 2188780
x-pantheon-styx-hostname: styx-fe3-a-857f974764-6bzgv
x-cache: HIT, HIT, HIT, MISS
fastly-io-info: ifsz=1277 idim=48x48 ifmt=png ofsz=976 odim=48x48 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 976
x-served-by: cache-mdw17350-MDW, cache-mdw17332-MDW, cache-fra19156-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.763530,VS0,VE5
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: a117b680-03cf-11eb-aa06-7ae2cf59cc15
expires: Sat, 02 Oct 2021 10:19:46 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 1, 1, 1, 0

GET
H2 200 use_cases_menu_image.jpg
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 15 KB
16 KB 54ms
54ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/use_cases_menu_image.jpg?itok=t2CzlWjd

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

913a3d6d72df757623fc7a1ef37ef84e60ffbff83cb9514aa01a39db05f7bee4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "xgQzsw1eUmUMk+mocFPy2y4aDYSCiyj9vhaqhltMTuo"
age: 2804510
x-pantheon-styx-hostname: styx-fe3-a-857f974764-dlq64
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=17090 idim=398x398 ifmt=jpeg ofsz=15748 odim=398x398 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 15748
x-served-by: cache-mdw17352-MDW, cache-mdw17377-MDW, cache-fra19137-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.777816,VS0,VE48
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 04e6b297-fe36-11ea-8c41-6a2b57a59b4f
expires: Sat, 25 Sep 2021 07:17:35 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 industries_menu_image.jpg
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 22 KB
22 KB 13ms
13ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/industries_menu_image.jpg?itok=IuH0OclF

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ce35f2450851af5e3b8e502f29a7048c7da4b7474061493711a15becf6fd7e0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "GzFYYKKK3rGet8QY60KAbhWj58eO6EbXcfayMG47Ru4"
age: 3906086
x-pantheon-styx-hostname: styx-fe3-b-5f5d494784-txgqb
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=22689 idim=398x397 ifmt=jpeg ofsz=22544 odim=398x397 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 22544
x-served-by: cache-mdw17359-MDW, cache-mdw17355-MDW, cache-fra19148-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.797732,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 36e43ca2-f431-11ea-84fc-82e5316e91a9
expires: Sun, 12 Sep 2021 13:17:59 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 rectangle_71-3.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 33 KB
33 KB 18ms
12ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/rectangle_71-3.png?itok=b8DIiSUt

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

325914d019287f222e9458ede59e620e3f5c581a5d30b24e7786e78e2f5f8f10

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "uXldOUkAFGYkXWQIXjnCW8Sd6QvrIK097RFitHcdzbw"
age: 996214, 996214
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6j5jb
x-cache: HIT, HIT, HIT, MISS
fastly-io-info: ifsz=36221 idim=280x148 ifmt=png ofsz=33718 odim=280x148 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 33718
x-served-by: cache-mdw17362-MDW, cache-mdw17328-MDW, cache-fra19178-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.828863,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 49d8f66e-0ea8-11eb-bd65-8a04a199118e
expires: Sat, 16 Oct 2021 05:35:52 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 1, 1, 1, 0

GET
H2 200 image.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 17 KB
17 KB 20ms
15ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/image.png?itok=N7Qe74av

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5e0be93fbb1f5666aa2b3d590684e4e4d13146da5856dd2a5794f0ba8e321b8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "XcRL0pJ9NxRsC3BgI/FYbjxtSBy0Zvk22NlupyT+yEk"
age: 3906084, 3906084
x-pantheon-styx-hostname: styx-fe3-a-857f974764-dvls5
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=20862 idim=280x148 ifmt=png ofsz=17098 odim=280x148 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 17098
x-served-by: cache-mdw17335-MDW, cache-mdw17327-MDW, cache-fra19146-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.828844,VS0,VE8
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 37d7fede-f431-11ea-af81-723751b68f48
expires: Sun, 12 Sep 2021 13:18:01 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 image-2.png
www.forcepoint.com/sites/default/files/styles/menu_image/public/ 17 KB
17 KB 24ms
19ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/menu_image/public/image-2.png?itok=58UFb4O7

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

04370a2d475c78b1551f863e340a8672d13754d94bb68eec6b15b589733bd20f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "NHYQF3LMzl2zOP4xg1TpWiJw1IkMtnYYOyB1Jm9Kyxw"
age: 2374616
x-pantheon-styx-hostname: styx-fe3-b-5f5d494784-lxfdb
x-cache: HIT, HIT, HIT, MISS
fastly-io-info: ifsz=19553 idim=280x148 ifmt=png ofsz=17266 odim=280x148 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 17266
x-served-by: cache-mdw17341-MDW, cache-mdw17326-MDW, cache-fra19164-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.828829,VS0,VE13
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: f1cbbeec-021e-11eb-879b-0a2df894a46a
expires: Thu, 30 Sep 2021 06:42:29 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 1, 1, 1, 0

GET
H2 200 gdGOAH9.png
i.imgur.com/ 22 KB
22 KB 89ms
34ms Image
image/png 151.101.112.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/gdGOAH9.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e07620fe04b0512241b54d21ef6be73105f3da02d9590fffc0d14dde31505b09

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
x-content-type-options: nosniff
age: 2225495
x-cache: HIT, HIT
status: 200
content-length: 22203
x-served-by: cache-bwi5144-BWI, cache-hhn4047-HHN
last-modified: Thu, 22 Sep 2016 09:13:42 GMT
server: cat factory 1.0
x-timer: S1603736366.886998,VS0,VE1
etag: "6e461acbddf2d0e8d4c974b42195b7c6"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 nBNmQ9l.png
i.imgur.com/ 20 KB
21 KB 89ms
34ms Image
image/png 151.101.112.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/nBNmQ9l.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

04024f7bc306691563fe715ae09ec38788d131385603101fd717a84d485f6b03

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
x-content-type-options: nosniff
age: 1673115
x-cache: HIT, HIT
status: 200
content-length: 20945
x-served-by: cache-bwi5125-BWI, cache-hhn4047-HHN
last-modified: Thu, 22 Sep 2016 09:13:41 GMT
server: cat factory 1.0
x-timer: S1603736366.886972,VS0,VE1
etag: "6aaf1ce012c507415af4aef8f16fb7c8"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 PtueRoI.png
i.imgur.com/ 6 KB
6 KB 89ms
34ms Image
image/png 151.101.112.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/PtueRoI.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

5c08480aacf1854cb0c6f5030ea1b72c953b89e3be8029698556df5703a4085a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
x-content-type-options: nosniff
age: 719153
x-cache: MISS, HIT
status: 200
content-length: 5964
x-served-by: cache-bwi5138-BWI, cache-hhn4047-HHN
last-modified: Thu, 22 Sep 2016 09:13:40 GMT
server: cat factory 1.0
x-timer: S1603736366.886968,VS0,VE1
etag: "380824510c383330355e7f9765c59d13"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 1

GET
H2 200 css_9BCXL2PNej5yvO2KnZ5YU846aPgU0fP5dQpx-xQNfsM.css
www.forcepoint.com/sites/default/files/css/ 7 KB
2 KB 116ms
113ms Stylesheet
text/css 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/css/css_9BCXL2PNej5yvO2KnZ5YU846aPgU0fP5dQpx-xQNfsM.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f410972f63cd7a3e72bced8a9d9e5853ce3a68f814d1f3f9750a71fb140d7ec3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f8db301-1a21"
age: 331733
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 1439
x-served-by: cache-mdw17361-MDW, cache-mdw17349-MDW, cache-fra19121-FRA, cache-fra19153-FRA
last-modified: Mon, 19 Oct 2020 15:38:41 GMT
server: nginx
x-timer: S1603736366.829407,VS0,VE108
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:33 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 6784c6ae-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 38205, 0, 0, 0

GET
H2 200 iUzjs8h.png
i.imgur.com/ 10 KB
10 KB 80ms
26ms Image
image/png 151.101.112.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/iUzjs8h.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

f69f0d278008c3c2ec3ab8a9ec6fc5725a9630daa745775f0da9b8c390167b32

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
x-content-type-options: nosniff
age: 719153
x-cache: MISS, HIT
status: 200
content-length: 10214
x-served-by: cache-bwi5136-BWI, cache-hhn4047-HHN
last-modified: Thu, 22 Sep 2016 09:14:56 GMT
server: cat factory 1.0
x-timer: S1603736366.886960,VS0,VE1
etag: "ff6cd60faaacb533d9a9df36d4b1a538"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 1

GET
H2 200 chris-panas-0yiy0xajjhq-unsplash.jpg
www.forcepoint.com/sites/default/files/styles/paragraph___hero_image___teaser___xlarge/public/hero/ 6 KB
7 KB 62ms
58ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/paragraph___hero_image___teaser___xlarge/public/hero/chris-panas-0yiy0xajjhq-unsplash.jpg?itok=Amy-C1Aw&timestamp=1603251439

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4d1a17044b0075f8f1089bfe74833f44697cb61e60c86287e8a191516abaa853

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "/Y0k6MehH94mN9azleIhhvTPQ4CETWkLlnflSOJ/SVA"
age: 450428
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6j5jb
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=7162 idim=387x240 ifmt=jpeg ofsz=6642 odim=387x240 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 6642
x-served-by: cache-mdw17369-MDW, cache-mdw17326-MDW, cache-fra19164-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.829495,VS0,VE52
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 0b3ee663-139f-11eb-bd65-8a04a199118e
expires: Fri, 22 Oct 2021 13:12:17 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 image_placeholder.gif
www.forcepoint.com/sites/all/modules/contrib/lazyloader/ 828 B
1 KB 17ms
13ms Image
image/gif 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/modules/contrib/lazyloader/image_placeholder.gif

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf401f0aec11d24c5272997dcb1ffb78c55df70499a70c7f0863b91e215a592b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "Kpd+TedBxySIGLFOhcKwL25G5FKFFcHJQGH7xnF3BKs"
age: 5833872
x-pantheon-styx-hostname: styx-fe3-b-7ccfb4b767-kkmsp
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=1887 idim=20x20 ifmt=gif ofsz=828 odim=20x20 ofmt=gif
status: 200
fastly-stats: io=1
content-length: 828
x-served-by: cache-mdw17333-MDW, cache-mdw17372-MDW, cache-fra19156-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.829503,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/gif
x-styx-req-id: bda86197-e2a8-11ea-9930-9a7691e92c5c
expires: Sat, 21 Aug 2021 05:48:15 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 1, 209, 0

GET
H2 200 2-future-insights2021-teal-pattern-2000x1333px.jpg
www.forcepoint.com/sites/default/files/styles/paragraph___hero_image___teaser___xlarge/public/hero/ 3 KB
3 KB 65ms
61ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/paragraph___hero_image___teaser___xlarge/public/hero/2-future-insights2021-teal-pattern-2000x1333px.jpg?itok=aKeYhLM9&timestamp=1603126508

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

6c83e5d7f0ded3288239450241b35c47335da6e5ed9d1cb87e2914039ae44da5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "hlNGtgreRNkn2Mq/Xlx0qBrxH7HIMRYhVbRYC0QZORw"
age: 539504
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=3611 idim=387x240 ifmt=jpeg ofsz=2670 odim=387x240 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 2670
x-served-by: cache-mdw17371-MDW, cache-mdw17353-MDW, cache-fra19160-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.829463,VS0,VE55
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: a5ce426e-12cf-11eb-afba-8e589cac6792
expires: Thu, 21 Oct 2021 12:27:41 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 2, 1, 0

GET
H2 200 1-future-insights2021-main-guy-look-right-2000x1333px_0.jpg
www.forcepoint.com/sites/default/files/styles/paragraph___hero_image___teaser___xlarge/public/hero/ 7 KB
7 KB 17ms
14ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/paragraph___hero_image___teaser___xlarge/public/hero/1-future-insights2021-main-guy-look-right-2000x1333px_0.jpg?itok=1ViYkYCK&timestamp=1602638021

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

396f21e0bf03d975ede7ee6d0f68c3d98641ac35374b1f6797e3f1b790c9f13f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "kn1KkkVoQoG1U/1m4exL8r9XxW4CAPqTlSfPcunmWZ8"
age: 1057745
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=7584 idim=387x240 ifmt=jpeg ofsz=7274 odim=387x240 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 7274
x-served-by: cache-mdw17345-MDW, cache-mdw17337-MDW, cache-fra19177-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.829439,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 06357d49-0e19-11eb-8de8-e6110f627779
expires: Fri, 15 Oct 2021 12:30:20 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 vpn.jpg
www.forcepoint.com/sites/default/files/styles/footer_menu_featured_blog/public/hero/ 3 KB
3 KB 18ms
15ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/default/files/styles/footer_menu_featured_blog/public/hero/vpn.jpg?itok=wVxTs1FC

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4634aac322fc2a16b04c959664ad321462df9360682556e381341d489c1326cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "KkM6H0iB70jkUpLqWSBvqCc+I0kudyxbbFajvB+QH5s"
age: 13124, 13124
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-2mqj6
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=2824 idim=199x111 ifmt=jpeg ofsz=2810 odim=199x111 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 2810
x-served-by: cache-mdw17324-MDW, cache-mdw17334-MDW, cache-fra19139-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.829435,VS0,VE8
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: 3887687a-1799-11eb-b605-56226c185009
expires: Wed, 27 Oct 2021 14:40:41 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 0, 1, 1, 0

GET
H2 200 js_YGsUV3Ce7aXBJBS23_v5HOE_E5QvyXDXhYBu_X7nNNU.js Show response
www.forcepoint.com/sites/default/files/js/ 23 KB
8 KB 112ms
112ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_YGsUV3Ce7aXBJBS23_v5HOE_E5QvyXDXhYBu_X7nNNU.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

606b1457709eeda5c12414b6dffbf91ce13f13942fc970d785806efd7ee734d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f6b4a09-5a28"
age: 331735, 331735, 331735, 331735
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 7808
x-served-by: cache-mdw17349-MDW, cache-mdw17349-MDW, cache-fra19155-FRA, cache-fra19153-FRA
last-modified: Wed, 23 Sep 2020 13:13:45 GMT
server: nginx
x-timer: S1603736365.231447,VS0,VE106
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:30 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 65f28214-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 6, 0, 0, 0

GET
H2 200 js_oaw9dVs4fCiUNWO4LbIth0obGSuoEZpLw_Fpeip-JYs.js Show response
www.forcepoint.com/sites/default/files/js/ 15 KB
6 KB 113ms
112ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_oaw9dVs4fCiUNWO4LbIth0obGSuoEZpLw_Fpeip-JYs.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a1ac3d755b387c28943563b82db22d874a1b192ba8119a4bc3f1697a2a7e258b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f7f1925-3a6f"
age: 331733, 331733, 331733
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 5862
x-served-by: cache-mdw17339-MDW, cache-mdw17357-MDW, cache-fra19142-FRA, cache-fra19153-FRA
last-modified: Thu, 08 Oct 2020 13:50:29 GMT
server: nginx
x-timer: S1603736365.344810,VS0,VE107
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:32 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 66ea6db8-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 33572, 0, 0, 0

GET
H2 200 js_tpyEWPXKXD8JNF7tS4uoWBSe7AyZ23SgHoYPbltZaK8.js Show response
www.forcepoint.com/sites/default/files/js/ 35 KB
10 KB 112ms
112ms Script
application/x-javascript 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/default/files/js/js_tpyEWPXKXD8JNF7tS4uoWBSe7AyZ23SgHoYPbltZaK8.js

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b69c8458f5ca5c3f09345eed4b8ba858149eec0c99db74a01e860f6e5b5968af

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f9200d3-8ad2"
age: 331732
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 10275
x-served-by: cache-mdw17370-MDW, cache-mdw17372-MDW, cache-fra19172-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:59:47 GMT
server: nginx
x-timer: S1603736365.459266,VS0,VE107
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:33 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-styx-req-id: 678c559f-14b3-11eb-b22b-ae96c617c498
x-cache-hits: 39421, 0, 0, 0

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.forcepoint.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=www.forcepoint.com&pId=9212681960631425886

4 B
484 B

268ms
193ms

Image
image/jpeg

99.86.2.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.forcepoint.com&pId=9212681960631425886
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-95.fra6.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Via: 1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
x-amzn-RequestId: 32711b7a-2cf1-4a7d-b534-2c47430e0a50
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5f97132e-6dd914a700f537d857a93754;Sampled=0
Connection: keep-alive
x-amz-apigw-id: VB_vQHNWoAMFdBw=
Content-Length: 4
X-Amz-Cf-Id: RH2SmA5KwmWw6mqhqnqjqJRnGZgjIPubePqcbVeGTtiRGoKZDnkZzA==

Redirect headers

Pragma: no-cache
Date: Mon, 26 Oct 2020 18:19:26 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.38:80
AN-X-Request-Uuid: de0cd4a0-b184-4dcc-baf3-0a3906ef25bd
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=www.forcepoint.com&pId=9212681960631425886
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 js_visitor_settings.php Show response
dev.visualwebsiteoptimizer.com/deploy/ 5 KB
2 KB 75ms
26ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=371490&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&random=0.7388250987686635
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 7cfa42d2fdc91cf59d03d7558e4d951dbb62ad4a1fa8b7ef6871159e6328cdce

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

status: 200
date: Mon, 26 Oct 2020 18:19:25 GMT
content-encoding: gzip
server: gfra1
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via: 1.1 google
content-type: application/javascript; charset=UTF-8

GET
H3-Q050 200 track-0ca7acdf418d8c12f3819dda65c35024.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 11 KB
4 KB 51ms
26ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/track-0ca7acdf418d8c12f3819dda65c35024.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=371490&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&random=0.7388250987686635
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 8209afd835a4210dbc2b46fea7d483434266a4a465c485ee9fdca694799133f2

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
content-encoding: br
last-modified: Mon, 26 Oct 2020 05:02:24 GMT
server: gfra1
status: 200
etag: "5f965860-da8"
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3496
via: 1.1 google

GET
H3-Q050 200 opa-56761856850233eb41e36332d7e3cf79.js Show response
dev.visualwebsiteoptimizer.com/analysis/4.0/ 91 KB
24 KB 52ms
27ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-56761856850233eb41e36332d7e3cf79.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=371490&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&random=0.7388250987686635
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 8f1993495d96383b5fd34d2f942fd512e285ec3eaeb0108f6e21bfd45b3a49e6

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
content-encoding: br
last-modified: Mon, 19 Oct 2020 05:30:35 GMT
server: gfra1
status: 200
etag: "5f8d247b-5dc4"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24004
via: 1.1 google

GET
H3-Q050 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
172 B 113ms
110ms Image
image/gif 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=371490&d=forcepoint.com&u=DE66A31504E6F62AE56DB36B0124894A9&h=6d0060fb0c407e7069711fd85d48fd3f&r=0.09726516278322284

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv1c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:25 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv1c
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H/1.1 200
OK vis_opt.js Show response
d5phz18u4wuww.cloudfront.net/ 168 KB
56 KB 96ms
33ms Script
text/javascript 143.204.208.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d5phz18u4wuww.cloudfront.net/vis_opt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.208.228 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-208-228.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e96ee4202dd697f4757a0c1502f5b3ae79c0d59d0823d80a80ac3ed97132d861

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Mon, 26 Oct 2020 17:58:31 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Thu, 02 May 2019 08:14:16 GMT
Server: AmazonS3
Age: 1261
ETag: "85932b0cd7c8dce121fa1923529a3189"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
Cache-Control: max-age=3600
X-Amz-Cf-Pop: FRA53-C1
Accept-Ranges: bytes
Content-Length: 57240
X-Amz-Cf-Id: bHaO0qCV3bp0KBB3qKv6iprCSvBI9e0UKu41Pl-MXEL-2oze3c05tw==

GET
H3-Q050 200 vis_opt-0ca7acdf418d8c12f3819dda65c35024.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 203 KB
58 KB 27ms
26ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/vis_opt-0ca7acdf418d8c12f3819dda65c35024.js
Requested by: Host: d5phz18u4wuww.cloudfront.net
URL: https://d5phz18u4wuww.cloudfront.net/vis_opt.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: b48339180c7ef70a3737ad1bc0a8c24f96878ed162a819bc44f5895f8b5c548e

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
content-encoding: br
last-modified: Mon, 26 Oct 2020 05:02:24 GMT
server: gfra1
status: 200
etag: "5f965860-e7dd"
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59357
via: 1.1 google

GET
H2 200 async-buttons.js Show response
ws.sharethis.com/button/ 89 KB
19 KB 30ms
27ms Script
application/javascript 2600:9000:20d7:5c00:3:c04e:c780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.sharethis.com/button/async-buttons.js
Requested by: Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/buttons.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:5c00:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: b80a71bbfd599367ed06d6cd8a59d87bf0b02aafde9b20b1554abcfbf00abae3

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 24 Oct 2020 22:48:07 GMT
content-encoding: gzip
server: nginx/1.16.1
age: 156678
etag: W/"5f80b36e-16245"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=259200
x-amz-cf-pop: ZAG50-C1
x-robots-tag: noindex, nofollow
x-amz-cf-id: _liWpOlHfFNxgzjmXibg5beN1yZ04EzDbdyYleL3w87UhLzC0ic62w==
via: 1.1 38a3f663851a0597e7026100a58b9b39.cloudfront.net (CloudFront)
expires: Tue, 27 Oct 2020 22:48:07 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/ 400 KB
110 KB 184ms
182ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 390521e00071f213b9c2037f0a536269e06950b4d9a45f63f71910d3e3bb790b

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:25 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 15:48:50 GMT
server: AkamaiNetStorage
etag: "a7236b124a9508c0665a879e1f218913:1603381730.215027"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
expires: Mon, 26 Oct 2020 18:24:25 GMT

GET
DATA 200
OK truncated
/ 166 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e2a8b16a227605843bcf04d32557fa5f790d17d5fae10db399f3ad6b75cae70

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 450 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77bfa66bf799ef1d5be3e464795aaca2f9a0587c1616b9671f7383623474f455

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 141 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1a5c0fb755eabd84fa9ee65115561abfc934cb67631d8392acc299bed349942d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 187 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c181c648e71e1f94dc9f3aa0aced539df9790bc1aa92494d7fe7b17c274767bf

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 660 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8892ffd9b6812e96fca28cf2b24a4a1e25711631d73141353f1ec57fcaf523b8

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 372 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6a4f005d0158d27d475991d4606ec4141f42917cc68835019d819c583957710

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 372 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0c810909068da447ca522f9770490722119d254f18905ae37e5e4a45e2c346c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 248 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de0c91884c0f70a3c8ab477b2637d9c9417fc74eb663bbe6eace7836e8b38fc3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 angle-right-black.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/ 121 B
386 B 114ms
113ms Image
image/svg+xml 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/angle-right-black.svg

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

6d9a7fd96a3f724833b9b68c20877b5701f64df5446138733baec495138cfb3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff33-79"
age: 331716, 331716, 331716, 331716, 331716
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 127
x-served-by: cache-mdw17338-MDW, cache-mdw17362-MDW, cache-fra19138-FRA, cache-fra19153-FRA
access-control-allow-origin: *
last-modified: Thu, 22 Oct 2020 21:52:51 GMT
server: nginx
x-timer: S1603736366.837215,VS0,VE107
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:49 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 716d935d-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 25640, 0, 0, 0

GET
DATA 200
OK truncated
/ 151 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52de4f853e32cbad1473948b54b45888a76d70bc156a906a4e90d3fe9d63384f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 icon-anchor-arrow-teal.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/ 655 B
674 B 119ms
113ms Image
image/svg+xml 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/icon-anchor-arrow-teal.svg

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

29aebe811bb2f84bd90cfdee7ffc4c4af62bb5d871fd683f8a85bf0852ce9163

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff33-28f"
age: 331715
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 400
x-served-by: cache-mdw17355-MDW, cache-mdw17355-MDW, cache-fra19168-FRA, cache-fra19153-FRA
access-control-allow-origin: *
last-modified: Thu, 22 Oct 2020 21:52:51 GMT
server: nginx
x-timer: S1603736366.846543,VS0,VE108
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:50 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-styx-req-id: 71b68261-14b3-11eb-a160-e6110f627779
x-cache-hits: 10, 0, 0, 0

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5801778ff84312987440fe98294960b5b514a764ce5cd09cd6afcffcf38862f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 356 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 79673753d63f34d0e4d8fcec94babbf043b27387bd7767d0ba8c354f3642a54c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 383 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 89f73af23bcadce2d0605735149c8a7ce2586cfcb9db7a158521b1ed9139e69e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a51ccbe50d3e48a6dbfab565c9cd32eb148afb8134890b8437fb85c2b09d0c74

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 f-white.svg
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/ 257 B
482 B 115ms
115ms Image
image/svg+xml 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/f-white.svg

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2a7b733b2f19d538893df08b2c194aef1201dbad6ee2ddafc5bcd34cbb482d6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff2d-101"
age: 331715, 331715, 331715, 331715
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-4g68v
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 187
x-served-by: cache-mdw17383-MDW, cache-mdw17380-MDW, cache-fra19124-FRA, cache-fra19153-FRA
access-control-allow-origin: *
last-modified: Thu, 22 Oct 2020 21:52:45 GMT
server: nginx
x-timer: S1603736366.854606,VS0,VE110
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept-Encoding, orig-host
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:50 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 71b6ced4-14b3-11eb-87e4-8e589cac6792
x-cache-hits: 32179, 0, 0, 0

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6116382548abaad3d6133a60e2dc187d88dfa1ed07d981311c0bbcfaee05cd49

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 ajax-loader.gif
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ 363 B
772 B 12ms
12ms Image
image/gif 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ajax-loader.gif

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f6111a2b70adc74b366e13097ef3bc968003d16bbebbd72d324cdb73edb32c36

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/css/css_WhoczOGTc2OA2SsxDmxyHX1yfT9afvyjUGBkKIJ6SJo.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "ga7U9bAOPM7Oepbue6I1XLSNh+Easwa5vEhZjyyparo"
age: 1600604, 1600604
x-pantheon-styx-hostname: styx-fe3-b-968b66656-kj24t
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=404 idim=43x11 ifmt=gif ofsz=363 odim=43x11 ofmt=gif ofrm=4
status: 200
fastly-stats: io=1
content-length: 363
x-served-by: cache-mdw17335-MDW, cache-mdw17332-MDW, cache-fra19158-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.856492,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/gif
x-styx-req-id: 15921ec3-0929-11eb-8829-aa9e051c7c3c
expires: Sat, 09 Oct 2021 05:42:42 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 0, 1, 1, 0

GET
DATA 200
OK truncated
/ 383 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b5c2800c52737f3425d0e434c93f9412da5e0491282c8d3d53b4d707202b8cef

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4cbc6a70cd3d48475ddbb975d3831d02e4158a76fcdb997891baa497ea31241

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 356 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6676353d7029b44112419ac26efd665e84021eb418ccf05a1e1f04d0ba46bd53

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 431 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af60288a11ae9864cdd707a9c6e13463359d5ffb6755bf9035a878f18b8758f9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 688 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ec291adef932c1e26510f560daef99d2d26b96331cbfd2f29fe234eaf2dddae

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

eu-cookie-compliance Show response
www.forcepoint.com/ajax/
Redirect Chain

https://www.forcepoint.com/ajax/eu-cookie-compliance/
https://www.forcepoint.com/ajax/eu-cookie-compliance

269 B
3 KB

116ms
116ms

XHR
application/json

2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/ajax/eu-cookie-compliance

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

705625f67416c089ec12f98067511c51064b70b57ee1241ba675a1030d26213c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: 'unsafe-inline' 'unsafe-eval' .fonts.net analyticsssl.forcepoint.com .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com static.ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com bam.nr-data.net maps.gstatic.com .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com dmp.theadex.com tag.aumago.com; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' pixel.cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net tags.w55c.net .demandbase.com .company-target.com maps.gstatic.com tags.tiqcdn.com munchkin.marketo.net .newrelic.com connect.facebook.net static.ads-twitter.com a.burly.io sjs.bizographics.com bam.nr-data.net snap.licdn.com https://websense.tt.omtrdc.net/m2/websense/mbox/json .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com attr.ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com app.vwo.com .js.ubembed.com assets.ubembed.com js.driftt.com cdn.vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com https://activitymap.adobe.com/sc15/activitymap/index.js .consensu.org .bizible.com dmp.theadex.com tag.aumago.com ws.zoominfo.com; img-src data: ; connect-src 'self' app.vwo.com dpm.demdex.net websense.tt.omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net dmp.theadex.com tag.aumago.com google-analytics.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: 'unsafe-inline' 'unsafe-eval' *.fonts.net analyticsssl.forcepoint.com *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com static.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com bam.nr-data.net maps.gstatic.com *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com dmp.theadex.com tag.aumago.com; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' pixel.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net tags.w55c.net *.demandbase.com *.company-target.com maps.gstatic.com tags.tiqcdn.com munchkin.marketo.net *.newrelic.com connect.facebook.net static.ads-twitter.com a.burly.io sjs.bizographics.com bam.nr-data.net snap.licdn.com https://websense.tt.omtrdc.net/m2/websense/mbox/json *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com attr.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com app.vwo.com *.js.ubembed.com assets.ubembed.com js.driftt.com cdn.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com https://activitymap.adobe.com/sc15/activitymap/index.js *.consensu.org *.bizible.com dmp.theadex.com tag.aumago.com ws.zoominfo.com; img-src * data: *; connect-src 'self' app.vwo.com dpm.demdex.net websense.tt.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net dmp.theadex.com tag.aumago.com google-analytics.com; report-uri /admin/config/system/seckit/csp-report
content-encoding: gzip
x-content-type-options: nosniff
age: 1665, 1665, 1665
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-6j5jb
x-cache: HIT, MISS, MISS, MISS
status: 200
from-origin: same, https://analyticsssl.forcepoint.com,https://vidyard.com
vary: Accept-Encoding, x-geo-country, orig-host
content-length: 177
etag: W/"1603734701-0"
x-served-by: cache-mdw17337-MDW, cache-mdw17369-MDW, cache-fra19174-FRA, cache-fra19153-FRA
last-modified: Mon, 26 Oct 2020 17:51:41 GMT
server: nginx
x-timer: S1603736366.121876,VS0,VE110
x-frame-options: SAMEORIGIN
date: Mon, 26 Oct 2020 18:19:26 GMT
strict-transport-security: max-age=18410000
content-language: en
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sun, 19 Nov 1978 05:00:00 GMT
cache-control: public, max-age=1800
accept-ranges: bytes, bytes, bytes
content-type: application/json
x-styx-req-id: e760f34e-17b3-11eb-bd65-8a04a199118e
x-drupal-cache: MISS
x-cache-hits: 3, 0, 0, 0

Redirect headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 0, 0, 0
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: MISS, MISS, MISS, MISS
status: 301
content-length: 0
x-served-by: cache-mdw17321-MDW, cache-mdw17361-MDW, cache-fra19178-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.946262,VS0,VE169
date: Mon, 26 Oct 2020 18:19:26 GMT
vary: x-geo-country, Cookie, orig-host
content-type: text/html; charset=UTF-8
location: https://www.forcepoint.com/ajax/eu-cookie-compliance
expires: Sun, 19 Nov 1978 05:00:00 GMT
cache-control: no-cache, must-revalidate
accept-ranges: bytes, bytes, bytes
x-styx-req-id: c798e39e-17b7-11eb-b22b-ae96c617c498
x-drupal-cache: MISS
x-cache-hits: 0, 0, 0, 0

GET
DATA 200
OK truncated
/ 199 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6408a837784b4b1e5bdce4b19d2bb4ff1c08c63eaebfe028bd91a559e7eceb8c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 chosen-sprite.png
www.forcepoint.com/sites/all/libraries/chosen/ 430 B
872 B 13ms
12ms Image
image/webp 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/libraries/chosen/chosen-sprite.png

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/default/files/css/css_faNxbZlG8sYJ1IiqfFXoOTUUnOTNzg59gAMKpmO43D0.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9cc77ec166565cf138f088e29b263d7de28ebff89c6ac6ac7b3226b8c2c45f33

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/sites/default/files/css/css_faNxbZlG8sYJ1IiqfFXoOTUUnOTNzg59gAMKpmO43D0.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "zv1lE2Lr9Kk1HzjHcZEB3/uXEUVp6pb4opLSEJON338"
age: 7942287, 7942287
x-pantheon-styx-hostname: styx-fe3-a-745747b57-7tdkd
x-cache: HIT, HIT, HIT, MISS
fastly-io-info: ifsz=538 idim=52x37 ifmt=png ofsz=430 odim=52x37 ofmt=webp
status: 200
fastly-stats: io=1
content-length: 430
x-served-by: cache-mdw17338-MDW, cache-mdw17331-MDW, cache-fra19127-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.955754,VS0,VE7
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/webp
x-styx-req-id: b34d2a01-cf7b-11ea-bd14-6202a924e034
expires: Tue, 27 Jul 2021 20:07:58 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 1, 1, 1, 0

GET
H2 200 getForm Show response
www.forcepoint.com/index.php/form/ 16 KB
4 KB 531ms
530ms XHR
application/json 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/index.php/form/getForm?munchkinId=018-NKF-008&form=2810&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/forms2.min.js?qimiwj

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fc6a0616e0a7cf3b8abaa2ab6a02147601829c741de3c870ab3df86aec4af5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=63113904
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
x-cache: MISS, MISS
status: 200
content-length: 3805
cf-request-id: 0607bc03930000062957991000000001
x-served-by: cache-fra19134-FRA, cache-fra19153-FRA
access-control-allow-origin: *
server: cloudflare
x-timer: S1603736366.961473,VS0,VE525
date: Mon, 26 Oct 2020 18:19:26 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, orig-host
content-type: application/json; charset=utf-8
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes, bytes
cf-ray: 5e862f7f5e180629-FRA
x-cache-hits: 0, 0

GET
H2 200 loading.gif
www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ 76 KB
77 KB 12ms
12ms Image
image/gif 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/loading.gif

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

dd0779c9ae69f9d8cd8728663703ce2cc6ec972dc5350a5f6948a15d67fbeea9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
etag: "1jEtdmhYtvyzN6Srr4mLY9uwHnV03vhqrN9WPOrXo7A"
age: 1587679, 1587679
x-pantheon-styx-hostname: styx-fe3-b-968b66656-22vm7
x-cache: MISS, HIT, HIT, MISS
fastly-io-info: ifsz=80522 idim=200x200 ifmt=gif ofsz=78220 odim=200x200 ofmt=gif ofrm=30
status: 200
fastly-stats: io=1
content-length: 78220
x-served-by: cache-mdw17350-MDW, cache-mdw17325-MDW, cache-fra19179-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.971578,VS0,VE6
date: Mon, 26 Oct 2020 18:19:25 GMT
vary: Accept, orig-host
content-type: image/gif
x-styx-req-id: 2d0fc2dd-0947-11eb-bd20-96af033f5235
expires: Sat, 09 Oct 2021 09:18:06 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes
x-cache-hits: 0, 1, 195, 0

GET
H3-Q050 200 worker-70faafffa0475802f5ee03ca5ff74179.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 47 KB
14 KB 51ms
26ms XHR
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-56761856850233eb41e36332d7e3cf79.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: br
last-modified: Mon, 16 Mar 2020 04:40:32 GMT
server: gfra1
status: 200
etag: "5e6f0340-351f"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13599
via: 1.1 google

GET
H2 200 portal-v2.html
c.sharethis.mgr.consensu.org/ Frame 6575 0
0 85ms
27ms Document
text/html 2600:9000:20d7:e800:c:a9b7:ddc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/portal-v2.html
Requested by: Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/buttons.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:e800:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: c.sharethis.mgr.consensu.org
:scheme: https
:path: /portal-v2.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Response headers

status: 200
content-type: text/html; charset=utf-8
accept-ranges: bytes
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 18:27:43 GMT
date: Mon, 26 Oct 2020 17:38:06 GMT
cache-control: max-age=3600, public
etag: W/"83a-174e56b8518"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 7ec84fa8ea386135e27faa4bc393cabb.cloudfront.net (CloudFront)
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: cobuNxl0ChW0cCrXUXoczpO9wKOoFVlnPVx2gh7Yw-SuEVQ7Fd7cww==
age: 2480

GET
H2 200 buttons-secure.css
ws.sharethis.com/button/css/ 23 KB
4 KB 27ms
24ms Stylesheet
text/css 2600:9000:20d7:5c00:3:c04e:c780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.sharethis.com/button/css/buttons-secure.css
Requested by: Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/async-buttons.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:5c00:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 95dc1b83a7c030dd13ab3e29df921f10e04208b28734f172ea232854264c3b05

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 17:38:11 GMT
content-encoding: gzip
last-modified: Fri, 09 Oct 2020 19:01:02 GMT
server: nginx/1.16.1
age: 2475
etag: "5f80b36e-5a76"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
status: 200
x-amz-cf-pop: ZAG50-C1
x-robots-tag: noindex, nofollow
content-length: 3851
via: 1.1 38a3f663851a0597e7026100a58b9b39.cloudfront.net (CloudFront)
x-amz-cf-id: P4PJQz_gCoFWkkVwZuYOsst5f9Sf0Ak5ILiCaDKVY_m6itmqZQ3EMQ==

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
340 B 127ms
29ms XHR
text/plain 18.185.151.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/pview?event=pview&version=buttons.js&lang=en&sessionID=1603736365815.77160&hostname=www.forcepoint.com&location=%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&product=widget&fcmp=false&fcmpv2=false&publisher=dr-1a8ea6fe-97f3-ecd7-f9ef-9fd1e2c0c34&bsamesite=true&consentDomain=.consensu.org&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&title=Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint&sop=false
Requested by: Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/buttons.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.151.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-151-20.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://www.forcepoint.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content pview
l.sharethis.com/ 0
315 B 30ms
30ms Image
text/plain 18.185.151.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.sharethis.com/pview?event=pview&version=buttons.js&lang=en&sessionID=1603736365815.77160&hostname=www.forcepoint.com&location=%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&product=widget&fcmp=false&fcmpv2=false&publisher=dr-1a8ea6fe-97f3-ecd7-f9ef-9fd1e2c0c34&bsamesite=true&consentDomain=.consensu.org&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&title=Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint&sop=false&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&img_pview=true
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.151.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-151-20.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=8DC067C25245AFA80A490D4C%40AdobeOrg&d_nsid=0&ts=1603736366267
https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=8DC067C25245AFA80A490D4C%40AdobeOrg&d_nsid=0&ts=1603736366267

370 B
1 KB

40ms
39ms

XHR
application/json

3.248.78.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=8DC067C25245AFA80A490D4C%40AdobeOrg&d_nsid=0&ts=1603736366267

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.78.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-78-233.eu-west-1.compute.amazonaws.com

Software

Resource Hash

5b26abbdb273ae2b78aa51fc484ceade76b355c124a78ef2a13bba032aba21c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-0d74368f2.edge-irl1.demdex.com 5.78.2.20201014153347 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: 3xHDua/1QR4=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.forcepoint.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 304
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.forcepoint.com
X-TID: aPURymijT/k=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=8DC067C25245AFA80A490D4C%40AdobeOrg&d_nsid=0&ts=1603736366267
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 86 KB
33 KB 79ms
17ms Script
application/x-javascript 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F85) /
Resource Hash: 4c77b84665a1e6bfb24ec928a1ed9045818099f6a6f2e26e2bb22a560067183f

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 23:42:39 GMT
server: ECS (pab/6F85)
age: 12012
etag: "8d42567cda8d61:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 33769

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
4ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 3818
date: Mon, 26 Oct 2020 17:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Mon, 26 Oct 2020 19:15:48 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 86ms
29ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 11ms
11ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=16851
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H2 200 / Show response
6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com/ 6 KB
2 KB 96ms
26ms Script
application/json 151.101.113.131
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com/
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.131 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d7abcb6ab268068a893726c4dca77b84fefbca4be2c86440bc1d4a4f6e5569d7

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: br
x-backend-region: eu_west_1
age: 588
x-amz-apigw-id: VB-TbGQcjoEFvNA=
etag: fb4639a232ace61f3a94b8b80974d228-v0.178.1
vary: Accept-Encoding, Referer
x-cache: Miss from cloudfront, HIT
content-type: application/json
status: 200
cache-control: max-age=0, must-revalidate
x-amz-cf-pop: FRA2-C1
accept-ranges: none
access-control-allow-origin: *

GET
H2 200 bt3rzfauhdaf.js Show response
js.driftt.com/include/1603736400000/ 137 KB
45 KB 281ms
182ms Script
application/javascript 65.9.190.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1603736400000/bt3rzfauhdaf.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.190.46 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "a48548cec5608126b24de4cbfe9bfb8d"
x-amz-cf-pop: ZAG50-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Tue, 13 Oct 2020 15:05:22 GMT
server: nginx
date: Mon, 26 Oct 2020 18:19:26 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 35262001a2ae8da534143b9a1e14d8fe.cloudfront.net (CloudFront)
cache-control: max-age=10
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JBbGyn1edxuUHl0q_3R8ErtAva9nN-609LzDK2d6EvR1QrJTHaq7EQ==

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

5 KB
2 KB

86ms
25ms

Script
application/javascript

151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
age: 74808
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4064-HHN
last-modified: Wed, 21 Oct 2020 21:46:56 GMT
x-timer: S1603736366.370103,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

Redirect headers

x-tw-cdn: VZ
Date: Mon, 26 Oct 2020 18:19:26 GMT
Server: ECS (fcn/4188)
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Location: https://static.ads-twitter.com/oct.js
Content-Length: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9839411

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

887691af38c1c894440f9faea8cafd39f8f742cc1b9a08d59759bd16babdf1d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37935
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Oct 2020 18:19:26 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 39 KB
13 KB 126ms
56ms Script
text/javascript 95.101.184.154
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.184.154 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a95-101-184-154.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: j1Ukz68kZImBJrgt6DlzhQICmRxkgWbz
Content-Encoding: gzip
ETag: "505601f096ee8dbb7ca2aafa3009e00c"
x-amz-request-id: A5FC37ED8D2F7777
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12342
x-amz-id-2: ISc998yNJQKgQqaD0u26MaM68l2NQT8xZLf8Or9BGN8GFzCaISuU8xeObCPkw23Jf+uppPT3dKo=
Last-Modified: Wed, 14 Oct 2020 20:21:11 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 18:19:26 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 88 KB
23 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/;
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23070
x-xss-protection: 0
pragma: public
x-fb-debug: j4RcG3aDr71ckY/S2YgViCumHnz++hgmWoOWw00+ReIcpxgXDUJZ4ElzPyJFQDFiWjGQvkLInkTZqez7Oz8kKQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Mon, 26 Oct 2020 18:19:26 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 84ms
26ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
age: 74812
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4064-HHN
last-modified: Wed, 21 Oct 2020 21:46:56 GMT
x-timer: S1603736366.370161,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 adex.js Show response
dmp.theadex.com/d/506/3014/s/ 40 KB
14 KB 127ms
56ms Script
application/javascript 89.163.159.104
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://dmp.theadex.com/d/506/3014/s/adex.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.163.159.104 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software: nginx /
Resource Hash: 2d6b3f3c5ff369d4df14f16820d8300a5c57ea938bc1f932421a5d6241f9e568

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
last-modified: Fri, 09 Oct 2020 07:26:02 GMT
server: nginx
etag: W/"5f80108a-a1c8"
content-type: application/javascript
status: 200
cache-control: max-age=300
access-control-allow-credentials: true
expires: Mon, 26 Oct 2020 18:24:26 GMT

GET
H2 200 2NSeEr5qA0s0pJTc3vV6 Show response
ws.zoominfo.com/pixel/ 0
724 B 287ms
269ms Script
text/javascript 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2NSeEr5qA0s0pJTc3vV6

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Express
status: 200
content-length: 0
cf-request-id: 0607bc04ff000064915b2a4000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 5e862f819d356491-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 118ms
116ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=websense/forcepoint-2018/202010221548&cb=1603736366292
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Mon, 26 Oct 2020 18:29:26 GMT

GET
H2

200

/
px.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=2141257&fmt=gif&_rnd=0.5842887408065405
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D2141257%26fmt%3Dgif%26_rnd%3D0.5842887408065405%26liSync%3Dtrue
https://px.ads.linkedin.com/collect/?pid=2141257&fmt=gif&_rnd=0.5842887408065405&liSync=true

43 B
181 B

150ms
150ms

Image
image/gif

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect/?pid=2141257&fmt=gif&_rnd=0.5842887408065405&liSync=true
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
server: Play
linkedin-action: 1
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: image/gif
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-length: 65
x-li-uuid: k7A5hrqdQRYASyCcrioAAA==
x-li-fabric: prod-ltx1

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: +8ABgLqdQRYQbe5sDCsAAA==
pragma: no-cache
x-li-pop: afd-prod-eda6
x-msedge-ref: Ref A: A50C3DD16DF042B6A142B17AA90EDD1A Ref B: VIEEDGE2811 Ref C: 2020-10-26T18:19:26Z
x-frame-options: sameorigin
date: Mon, 26 Oct 2020 18:19:25 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect/?pid=2141257&fmt=gif&_rnd=0.5842887408065405&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
px.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=1681282&fmt=gif&_rnd=0.6692908053642495
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D1681282%26fmt%3Dgif%26_rnd%3D0.6692908053642495%26liSync%3Dtrue
https://px.ads.linkedin.com/collect/?pid=1681282&fmt=gif&_rnd=0.6692908053642495&liSync=true

43 B
117 B

151ms
151ms

Image
image/gif

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect/?pid=1681282&fmt=gif&_rnd=0.6692908053642495&liSync=true
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
server: Play
linkedin-action: 1
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: image/gif
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-length: 65
x-li-uuid: Axv9hrqdQRbQQybUrioAAA==
x-li-fabric: prod-ltx1

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: SRQDgLqdQRYwSgXeIisAAA==
pragma: no-cache
x-li-pop: afd-prod-eda6
x-msedge-ref: Ref A: D23210EA499F42599880B19793B9B0ED Ref B: VIEEDGE2811 Ref C: 2020-10-26T18:19:26Z
x-frame-options: sameorigin
date: Mon, 26 Oct 2020 18:19:25 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect/?pid=1681282&fmt=gif&_rnd=0.6692908053642495&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 33ms
16ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 17:35:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 2626
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Mon, 26 Oct 2020 18:35:40 GMT

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 18ms
17ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=16844
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H2 200 168348421119586 Show response
connect.facebook.net/signals/config/ 234 KB
69 KB 45ms
44ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/168348421119586?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fe1204692b14773ce1f8a8b10ca5334c73331ef62739c0165e9877e5e89b62d3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: IlQgqBYKAnFnjjz+CIeEGh3ybIY/w0VEYGaU5OzOd7pae6BF16Z/wTV48Xq8zqjVgEVjs03epFegnUhVjVhvqw==
x-fb-trip-id: 664085054
date: Mon, 26 Oct 2020 18:19:26 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
90 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-72298027-1&cid=1198574995.1603736366&jid=1406760067&gjid=546389042&_gid=557428824.1603736366&_u=KGBAgAAjAAAAAE~&z=1269187441

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 26 Oct 2020 18:19:26 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.forcepoint.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
221 B 6ms
6ms Image
image/gif 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1432414822&t=pageview&_s=1&dl=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&ul=en-us&de=UTF-8&dt=Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KGBAgAAj~&jid=1406760067&gjid=546389042&cid=1198574995.1603736366&tid=UA-72298027-1&_gid=557428824.1603736366&z=1873528813

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 00:08:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 65457
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Cookie set dest5.html
websenseinc.demdex.net/ Frame 2C2A 0
0 196ms
40ms Document
text/html 52.30.191.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://websenseinc.demdex.net/dest5.html?d_nsid=0

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.30.191.169 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-191-169.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: websenseinc.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=04666446448492738122807294436445648538
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 15 Oct 2020 13:54:56 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=04666446448492738122807294436445648538;Path=/;Domain=.demdex.net;Expires=Sat, 24-Apr-2021 18:19:26 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: SDGLnS/YS58=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
analyticsssl.forcepoint.com/ 48 B
514 B 222ms
45ms XHR
application/x-javascript 35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://analyticsssl.forcepoint.com/id?d_visid_ver=4.1.0&d_fieldgroup=A&mcorgid=8DC067C25245AFA80A490D4C%40AdobeOrg&mid=09070401241205107793177902585707957365&ts=1603736366359

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

51005d3e85613d1bca816179264b86b7b646ad3ff5a36f1ed3d90d37bdfb22ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Mon, 26 Oct 2020 18:19:26 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-7dd9449d74-pmqvf
vary: Origin
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.forcepoint.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X5cTLgAAB59kBlL0
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=04666446448492738122807294436445648538
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5cTLgAAB59kBlL0

42 B
915 B

39ms
38ms

Image
image/gif

3.248.78.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5cTLgAAB59kBlL0

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.78.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-78-233.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-0295d6bbf.edge-irl1.demdex.com 5.78.2.20201014153347 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: Y0zsSXMfRuw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Mon, 26 Oct 2020 18:19:25 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5cTLgAAB59kBlL0
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 31ms
30ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-72298027-1&cid=1198574995.1603736366&jid=1406760067&_u=KGBAgAAjAAAAAE~&z=1816135950

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 30ms
29ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-72298027-1&cid=1198574995.1603736366&jid=1406760067&_u=KGBAgAAjAAAAAE~&z=1816135950

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/155/ 9 KB
4 KB 31ms
31ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/155/munchkin.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/js/munchkin.js?qimiwj
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Content-Encoding: gzip
Last-Modified: Fri, 30 Nov 2018 03:18:20 GMT
Server: AkamaiNetStorage
ETag: "c67dad42946949112916578f78706df8:1543547900"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 3923
Expires: Wed, 03 Feb 2021 18:19:26 GMT

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
304 B 18ms
18ms Image
image/gif 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=0061379a39254c53eeb2bed17203de9f&_biz_s=92f22e&_biz_l=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&_biz_t=1603736366391&_biz_i=Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint%20&_biz_n=0&rnd=511737&cdn_o=a&_biz_z=1603736366392
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F9A) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Fri, 23 Oct 2020 13:34:04 GMT
server: ECS (pab/6F9A)
age: 276322
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
204 B 27ms
17ms Image
image/gif 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=0061379a39254c53eeb2bed17203de9f&_biz_s=92f22e&_biz_l=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&_biz_t=1603736366397&_biz_i=Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint%20&rnd=289492&cdn_o=a&_biz_z=1603736366397
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F90) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Fri, 23 Oct 2020 02:05:02 GMT
server: ECS (pab/6F90)
age: 317664
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 bundle.js Show response
assets.ubembed.com/universalscript/releases/v0.178.1/ 162 KB
46 KB 160ms
59ms Script
application/javascript 65.9.190.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.ubembed.com/universalscript/releases/v0.178.1/bundle.js
Requested by: Host: 6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com
URL: https://6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.190.35 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: df25786bc3951d78d0f763a2a75a1f33b01b8ae2a5157831d2cf4d0348c2ede7

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Sep 2020 14:40:43 GMT
content-encoding: gzip
last-modified: Wed, 11 Dec 2019 22:14:50 GMT
server: AmazonS3
age: 3987524
etag: W/"2c662c7609e2ae1af50939453dcb717e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: 9hTqlfyvhXD5fbYpv-kDhl7xmCiuL_roPEN6BGBzZQHsN9prgg3_Dw==
via: 1.1 32e17fe5a1e4cb77ad8ac75ddb0c4584.cloudfront.net (CloudFront)

GET
H2 200 adsct
t.co/i/ 43 B
447 B 189ms
135ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=l6a6s&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 112
pragma: no-cache
last-modified: Mon, 26 Oct 2020 18:19:26 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 8f4645e318aa040ef3c2c0f0127f0f0d
x-transaction: 008e04a800a5e59e
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
125 B 182ms
141ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=o3qcd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Mon, 26 Oct 2020 18:19:26 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 8f4645e318aa040ef3c2c0f0127f0f0d
x-transaction: 00d3f676005da9e8
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=258729&time=1603736366408&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D258729%26time%3D1603736366408%26url%3Dhttps%253A%252F%252Fwww.forcepoint.com%252F...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=258729&time=1603736366408&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&liSync=true

0
45 B

150ms
147ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=258729&time=1603736366408&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&liSync=true
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
server: Play
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: Yk4xirqdQRag+IMxryoAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: BEZcg7qdQRYQki9AVSsAAA==
pragma: no-cache
x-li-pop: afd-prod-eda6
x-msedge-ref: Ref A: 4D4FB915AB5C48F3A88C5462534F2F64 Ref B: VIEEDGE2811 Ref C: 2020-10-26T18:19:26Z
x-frame-options: sameorigin
date: Mon, 26 Oct 2020 18:19:25 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=258729&time=1603736366408&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/2GRHXEZSJNFRTPMEC6ZM2B/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

31ms
31ms

Script
application/javascript

95.101.184.154
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.184.154 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a95-101-184-154.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2U8XMvdFINXJNFsilaXONuSvqmREKV3.
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: 1A9B20964D06B60E
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: oGa0tXTYZ/Y22McTMsl8vupTGJS+JWH55AMNCM50bhXJ/CjZYnnPdNfbo9gEZxtNtMgnerShNsI=
Last-Modified: Fri, 31 Jul 2020 16:11:15 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 18:19:27 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Mon, 26 Oct 2020 18:19:27 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/2GRHXEZSJNFRTPMEC6ZM2B/GCI6D323NJAJFLW5TKGUK5/ 1 KB
1 KB 91ms
36ms Script
text/javascript 95.101.184.154
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/2GRHXEZSJNFRTPMEC6ZM2B/GCI6D323NJAJFLW5TKGUK5/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.184.154 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a95-101-184-154.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: RyUlowaR2QvifaisklEwmlCtOGS7jpQJ
Content-Encoding: gzip
ETag: "3996d65282dd996ee0d7d4c90c139158"
x-amz-request-id: 12815A5268978BA9
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 635
x-amz-id-2: WClA/5Ge8sBFctfmfycZrnGJl6Bg7pr4c89rYDjuf4qeECVb1NKWyDHqfa5vJYMT9AHh0vjQT5g=
Last-Modified: Mon, 26 Oct 2020 10:07:53 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 18:19:26 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/2GRHXEZSJNFRTPMEC6ZM2B/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/2GRHXEZSJNFRTPMEC6ZM2B?_s=2a805339134001a315e571255f251d1e&_b=2
https://d.adroll.com/consent/check/2GRHXEZSJNFRTPMEC6ZM2B/?_s=2a805339134001a315e571255f251d1e&_b=2

385 B
477 B

40ms
37ms

Script
application/javascript

54.171.28.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/2GRHXEZSJNFRTPMEC6ZM2B/?_s=2a805339134001a315e571255f251d1e&_b=2
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.28.113 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-28-113.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: c499b1afa176ed0e1222b897f02152b5355a22e0d403eaf0f2759838ee844234

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 26 Oct 2020 18:19:26 GMT
server: nginx/1.18.0
content-length: 385
content-type: application/javascript

Redirect headers

status: 302
date: Mon, 26 Oct 2020 18:19:26 GMT
server: nginx/1.18.0
content-length: 105
location: https://d.adroll.com/consent/check/2GRHXEZSJNFRTPMEC6ZM2B/?_s=2a805339134001a315e571255f251d1e&_b=2

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
411 B 140ms
139ms Script
text/javascript 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=0061379a39254c53eeb2bed17203de9f&_biz_h=-1906410348&cdn_o=a&jsVer=4.20.08.28
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6FAE) /
Resource Hash: 483b45552b36368e93721f70777d2fc7c793cffda42afd38dbfa6281694e231e

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-encoding: gzip
server: ECS (pab/6FAE)
etag: F525103C
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: private, must-revalidate, max-age=21600
content-type: text/javascript; charset=utf-8
content-length: 218

GET
H2

200

trace.js Show response
dmp.theadex.com/
Redirect Chain

https://dmp.theadex.com/trace.js?adex_consent=1
https://dmp.theadex.com/trace.js?adex_consent=1&axd_sc=4241747781479856255

357 B
517 B

30ms
30ms

Script
application/javascript

89.163.159.104
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://dmp.theadex.com/trace.js?adex_consent=1&axd_sc=4241747781479856255
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.163.159.104 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software: nginx /
Resource Hash: 2ea444232041ca2742d6fa16436771e31bd9871c72b5ecc2850040509b12f5af

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:26 GMT
server: nginx
content-type: application/javascript
status: 200
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
content-length: 357
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:26 GMT
server: nginx
status: 303
p3p: CP="CAO PSAa PSDa IVAa IVDa OUR UNI COM NAV"
location: ?adex_consent=1&axd_sc=4241747781479856255
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
content-length: 0
expires: 0

GET
H2 200 529994084364752 Show response
connect.facebook.net/signals/config/ 234 KB
68 KB 40ms
40ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/529994084364752?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

527ce22593bfcd6e20caa955f7f3ee14538001d5077c5f24d3bd52a31b36dd34

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: zLl5Fzy0RhfKlnoHhcwp5C1xoonObfFxKLZadolJWxOFG4KoBnOaYmmilKv5/+lz1bnpcnjoKkFbCTC2vG0r1g==
x-fb-trip-id: 664085054
date: Mon, 26 Oct 2020 18:19:26 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
258 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=168348421119586&ev=PageView&dl=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&rl=&if=false&ts=1603736366463&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1603736366462.1721142792&it=1603736366317&coo=false&rqm=GET

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Oct 2020 18:19:26 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=168348421119586&ev=PageView&dl=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&rl=&if=false&ts=1603736366465&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmtealium&ec=1&o=30&fbp=fb.1.1603736366462.1721142792&it=1603736366317&coo=false&tm=1&rqm=GET

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Oct 2020 18:19:26 GMT

GET
H/1.1 200
OK visitWebPage Show response
018-nkf-008.mktoresp.com/webevents/ 2 B
311 B 494ms
102ms XHR
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://018-nkf-008.mktoresp.com/webevents/visitWebPage?_mchNc=1603736366472&_mchCn=&_mchId=018-NKF-008&_mchTk=_mch-forcepoint.com-1603736366472-74347&_mchHo=www.forcepoint.com&_mchPo=&_mchRu=%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:26 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 8c7229fc-6b08-4d6f-8cd4-e66063c1c538

GET
H2

200

forms2.css
www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/
Redirect Chain

https://www.forcepoint.com/js/forms2/css/forms2.css
https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css

13 KB
3 KB

165ms
165ms

Stylesheet
text/css

2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff31-33f8"
age: 331731, 331731, 331731, 331731, 331731
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 3158
x-served-by: cache-mdw17373-MDW, cache-mdw17355-MDW, cache-fra19162-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:49 GMT
server: nginx
x-timer: S1603736367.633768,VS0,VE159
date: Mon, 26 Oct 2020 18:19:26 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:35 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes, bytes, bytes
x-styx-req-id: 68ebfa52-14b3-11eb-a160-e6110f627779
x-cache-hits: 44869, 0, 0, 0

Redirect headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 70319, 70319, 70319, 70319
x-cache: HIT, MISS, MISS, MISS
status: 301
x-cache-hits: 277, 0, 0, 0
content-length: 0
x-served-by: cache-mdw17368-MDW, cache-mdw17344-MDW, cache-fra19179-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.497535,VS0,VE114
date: Mon, 26 Oct 2020 18:19:26 GMT
vary: x-geo-country, Cookie, orig-host
content-type: text/html; charset=UTF-8
location: https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css
cache-control: public, max-age=86400
accept-ranges: bytes, bytes, bytes, bytes
x-styx-req-id: 0e262e31-1714-11eb-b605-56226c185009
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-2mqj6

GET
H2

200

forms2.css
www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/
Redirect Chain

https://www.forcepoint.com/js/forms2/css/forms2-theme-simple.css
https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css

13 KB
3 KB

281ms
281ms

Stylesheet
text/css

2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"5f91ff31-33f8"
age: 331731, 331731
x-pantheon-styx-hostname: styx-fe3-b-6776458c68-7wjkb
x-cache: HIT, MISS, MISS, MISS
status: 200
content-length: 3158
x-served-by: cache-mdw17373-MDW, cache-mdw17367-MDW, cache-fra19153-FRA, cache-fra19153-FRA
last-modified: Thu, 22 Oct 2020 21:52:49 GMT
server: nginx
x-timer: S1603736367.634687,VS0,VE275
date: Mon, 26 Oct 2020 18:19:26 GMT
vary: Accept-Encoding, orig-host
content-type: text/css
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sat, 23 Oct 2021 22:10:35 GMT
cache-control: max-age=31622400
accept-ranges: bytes, bytes, bytes
x-styx-req-id: 68ebfa52-14b3-11eb-a160-e6110f627779
x-cache-hits: 44870, 0, 0, 0

Redirect headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 70320, 70320
x-cache: HIT, MISS, MISS, MISS
status: 301
x-cache-hits: 279, 0, 0, 0
content-length: 0
x-served-by: cache-mdw17365-MDW, cache-mdw17368-MDW, cache-fra19180-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736366.498182,VS0,VE117
date: Mon, 26 Oct 2020 18:19:26 GMT
vary: x-geo-country, Cookie, orig-host
content-type: text/html; charset=UTF-8
location: https://www.forcepoint.com/sites/all/modules/features/feature_ws_marketo/css/forms2.css
cache-control: public, max-age=86400
accept-ranges: bytes, bytes
x-styx-req-id: 0e26016d-1714-11eb-b22b-ae96c617c498
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7

GET
H2 200 u
cdn.bizible.com/m/ 43 B
119 B 16ms
16ms Image
image/gif 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/u?mapType=ecid&mapValue=8DC067C25245AFA80A490D4C%40AdobeOrg_09070401241205107793177902585707957365&_biz_u=0061379a39254c53eeb2bed17203de9f&_biz_s=92f22e&_biz_l=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&_biz_t=1603736366398&_biz_i=Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint%20&_biz_n=1&rnd=149841&cdn_o=a&_biz_z=1603736366503
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F8C) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Mon, 26 Oct 2020 17:17:08 GMT
server: ECS (pab/6F8C)
age: 3738
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
DATA 200
OK truncated
/ 648 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ba206ae667f1642cd0a35950bee63b5f3df2a147d04272a5f3aba7e2d53167aa

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 /
dmp.theadex.com/r/506/3014/ Frame 34CF 0
0 30ms
29ms Document
text/html 89.163.159.104
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://dmp.theadex.com/r/506/3014/?c=4241747781479856255&adex_consent=1&adex_consent_origin=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&adex_consent_checked=1603736366
Requested by: Host: dmp.theadex.com
URL: https://dmp.theadex.com/d/506/3014/s/adex.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.163.159.104 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: dmp.theadex.com
:scheme: https
:path: /r/506/3014/?c=4241747781479856255&adex_consent=1&adex_consent_origin=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&adex_consent_checked=1603736366
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: axd=4241747781479856255
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Response headers

status: 200
server: nginx
date: Mon, 26 Oct 2020 18:19:26 GMT
content-type: text/html; charset=UTF-8
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true
content-encoding: gzip

GET
H2 200 s45365198783288
analyticsssl.forcepoint.com/b/ss/websense-fp-prod/1/JS-2.12.0/ 43 B
329 B 38ms
38ms Image
image/gif 35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analyticsssl.forcepoint.com/b/ss/websense-fp-prod/1/JS-2.12.0/s45365198783288?AQB=1&ndh=1&pf=1&t=26%2F9%2F2020%2019%3A19%3A26%201%20-60&sdid=4580534CA6C559EB-488648C555A7BA99&mid=09070401241205107793177902585707957365&aamlh=6&ce=UTF-8&pageName=fp%3Ablog%3Ax%20labs%3Azeus%20delivered%20deloader%20defraud%20customers%20canadian%20banks&g=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&cc=USD&ch=blog&server=www.forcepoint.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=blog%20article&v1=blog%20article&v2=blog&c3=blog%3Ax%20labs&v3=blog%3Ax%20labs&v4=D%3DpageName&v9=de&v10=emea%20-%20europe%2C%20middle%20east%20and%20africa&v11=english&c15=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&v18=no%20value&c20=3826&c21=2.12.0&c22=fp%3Aus%3Ablog%3Ax%20labs%3Azeus%20delivered%20deloader%20defraud%20customers%20canadian%20banks&v34=x%20labs&v35=zeus%20delivered%20by%20deloader%20to%20defraud%20customers%20of%20canadian%20banks&v36=nicholas%20griffin&v37=2016-09-22&v47=D%3Dg&v50=D%3Dc15&v63=fp%3Aus%3Ablog%3Ax%20labs%3Azeus%20delivered%20deloader%20defraud%20customers%20canadian%20banks&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=8DC067C25245AFA80A490D4C%40AdobeOrg&AQE=1

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
x-content-type-options: nosniff
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
status: 200
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 27 Oct 2020 18:19:26 GMT
server: jag
xserver: anedge-7dd9449d74-49rv8
etag: 3443997621773238272-4621691533701285067
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sun, 25 Oct 2020 18:19:26 GMT

GET
H/1.1 200
OK e.html
6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com/c2ee68b3-633d-4717-b374-6c081963ff9f/ Frame 6B66 0
0 104ms
30ms Document
text/html 18.196.95.178
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com/c2ee68b3-633d-4717-b374-6c081963ff9f/e.html?closedAt=0
Requested by: Host: assets.ubembed.com
URL: https://assets.ubembed.com/universalscript/releases/v0.178.1/bundle.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.196.95.178 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Host: 6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
p3p: CP="This is not a privacy policy."
x-unbounce-pageid: c2ee68b3-633d-4717-b374-6c081963ff9f
etag: 6c48db85f66f2764c52875e0eb6d383b
last-modified: Thu, 22 Oct 2020 18:50:45 GMT
content-encoding: gzip
x-proxy-backend: page-server
connection: close

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=529994084364752&ev=PageView&dl=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&rl=&if=false&ts=1603736366684&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1603736366462.1721142792&it=1603736366317&coo=false&tm=1&rqm=GET

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Oct 2020 18:19:26 GMT

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 396 KB
55 KB 31ms
30ms Script
application/javascript 95.101.184.154
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.184.154 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a95-101-184-154.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: RrXoTAgO8kW4lHaNUHggiN0CFoNQqBuA
Content-Encoding: gzip
ETag: "14827d9b396da2c054681d43b60bfefa"
x-amz-request-id: 57E2003DC56C713B
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 55061
x-amz-id-2: JKKgFx0CVUqP4MugVBS2tyEvRc3Ls2irIraYGHXwHsD1qkvBARSTW444F9pF7k/6qWfAIY8k/Rc=
Last-Modified: Wed, 21 Oct 2020 17:43:14 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 18:19:26 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Akamai-Path-Stats: [1:10041:4294959255]

GET
H/1.1 200
OK favicon-32x32.png
nextroll.com/ 2 KB
2 KB 295ms
96ms Image
image/png 52.0.105.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextroll.com/favicon-32x32.png
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.105.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 18:19:27 GMT
Via: 1.1 vegur
Last-Modified: Thu, 15 Oct 2020 16:16:02 GMT
Server: Apache
Etag: "64f-5b1b7f6d77480"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1615

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=168348421119586&ev=Microdata&dl=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&rl=&if=false&ts=1603736366967&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint%20%22%7D&cd[OpenGraph]=%7B%22og%3Asite_name%22%3A%22Forcepoint%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks%22%2C%22og%3Atitle%22%3A%22Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%22%2C%22og%3Aupdated_time%22%3A%222018-07-10T16%3A37%3A57-05%3A00%22%2C%22og%3Aimage%3Atype%22%3A%22image%2Fpng%22%2C%22article%3Apublished_time%22%3A%222016-09-22T04%3A16%3A22-05%3A00%22%2C%22article%3Amodified_time%22%3A%222018-07-10T16%3A37%3A57-05%3A00%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmtealium&ec=2&o=30&fbp=fb.1.1603736366462.1721142792&it=1603736366317&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:26 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Oct 2020 18:19:26 GMT

POST
H2 200 csp-report
www.forcepoint.com/admin/config/system/seckit/ 0
3 KB 192ms
191ms Other
text/html 2a04:4e42::740
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.forcepoint.com/admin/config/system/seckit/csp-report

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::740 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: 'unsafe-inline' 'unsafe-eval' .fonts.net analyticsssl.forcepoint.com .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com static.ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com bam.nr-data.net maps.gstatic.com .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com dmp.theadex.com tag.aumago.com; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' pixel.cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net tags.w55c.net .demandbase.com .company-target.com maps.gstatic.com tags.tiqcdn.com munchkin.marketo.net .newrelic.com connect.facebook.net static.ads-twitter.com a.burly.io sjs.bizographics.com bam.nr-data.net snap.licdn.com https://websense.tt.omtrdc.net/m2/websense/mbox/json .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com attr.ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com app.vwo.com .js.ubembed.com assets.ubembed.com js.driftt.com cdn.vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com https://activitymap.adobe.com/sc15/activitymap/index.js .consensu.org .bizible.com dmp.theadex.com tag.aumago.com ws.zoominfo.com; img-src data: ; connect-src 'self' app.vwo.com dpm.demdex.net websense.tt.omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net dmp.theadex.com tag.aumago.com google-analytics.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/csp-report

Response headers

content-security-policy: default-src 'self' data: 'unsafe-inline' 'unsafe-eval' *.fonts.net analyticsssl.forcepoint.com *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com static.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com bam.nr-data.net maps.gstatic.com *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com dmp.theadex.com tag.aumago.com; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' pixel.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net tags.w55c.net *.demandbase.com *.company-target.com maps.gstatic.com tags.tiqcdn.com munchkin.marketo.net *.newrelic.com connect.facebook.net static.ads-twitter.com a.burly.io sjs.bizographics.com bam.nr-data.net snap.licdn.com https://websense.tt.omtrdc.net/m2/websense/mbox/json *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com attr.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com app.vwo.com *.js.ubembed.com assets.ubembed.com js.driftt.com cdn.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com https://activitymap.adobe.com/sc15/activitymap/index.js *.consensu.org *.bizible.com dmp.theadex.com tag.aumago.com ws.zoominfo.com; img-src * data: *; connect-src 'self' app.vwo.com dpm.demdex.net websense.tt.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net dmp.theadex.com tag.aumago.com google-analytics.com; report-uri /admin/config/system/seckit/csp-report
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-pantheon-styx-hostname: styx-fe3-a-d687769c6-ct4b7
x-cache: MISS, MISS, MISS, MISS
status: 200
from-origin: same, https://analyticsssl.forcepoint.com,https://vidyard.com
vary: Accept-Encoding, x-geo-country, Cookie, orig-host
content-length: 20
x-served-by: cache-mdw17345-MDW, cache-mdw17345-MDW, cache-fra19153-FRA, cache-fra19153-FRA
server: nginx
x-timer: S1603736367.044909,VS0,VE185
x-frame-options: SAMEORIGIN
date: Mon, 26 Oct 2020 18:19:27 GMT
strict-transport-security: max-age=18410000
content-language: en
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
expires: Sun, 19 Nov 1978 05:00:00 GMT
cache-control: no-cache, must-revalidate
accept-ranges: bytes
content-type: text/html; charset=UTF-8
x-styx-req-id: c841fb01-17b7-11eb-b22b-ae96c617c498
x-drupal-cache: MISS
x-cache-hits: 0, 0, 0, 0

GET embeddableActivated
6634a5cdf59e4bb3a8f70dcd111da346.events.ubembed.com/ 0
0

GET
H2 200 1.gif
dmp.theadex.com/d/506/3014/i/ 36 B
306 B 29ms
29ms Image
image/gif 89.163.159.104
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.theadex.com/d/506/3014/i/1.gif?c=4241747781479856255&t=1&location=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&protocol=https%3A%2F%2F&tzo=-60&date=1603736366&sw=1600&sh=1200&sd=24&pd=24&saw=1600&sah=1200&vw=1600&vh=1200&pmt=Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks&r=49614ad4c479a7a36ddcd57943e16ba7&c=4241747781479856255&adex_consent=1&adex_consent_origin=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&adex_consent_checked=1603736366
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.163.159.104 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software: nginx /
Resource Hash: 204265a6f1fc8529e4a64cff2c17c04709b46455f93003d24edb50bd78977223

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 18:19:27 GMT
server: nginx
p3p: CP="CAO PSAa PSDa IVAa IVDa OUR UNI COM NAV"
status: 200
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
content-length: 36
expires: 0

GET
H2 200 /
www.facebook.com/tr/ 44 B
146 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=529994084364752&ev=Microdata&dl=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&rl=&if=false&ts=1603736367186&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%20%7C%20Forcepoint%20%22%7D&cd[OpenGraph]=%7B%22og%3Asite_name%22%3A%22Forcepoint%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks%22%2C%22og%3Atitle%22%3A%22Zeus%20Delivered%20by%20DELoader%20to%20Defraud%20Customers%20of%20Canadian%20Banks%22%2C%22og%3Aupdated_time%22%3A%222018-07-10T16%3A37%3A57-05%3A00%22%2C%22og%3Aimage%3Atype%22%3A%22image%2Fpng%22%2C%22article%3Apublished_time%22%3A%222016-09-22T04%3A16%3A22-05%3A00%22%2C%22article%3Amodified_time%22%3A%222018-07-10T16%3A37%3A57-05%3A00%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmtealium&ec=1&o=30&fbp=fb.1.1603736366462.1721142792&it=1603736366317&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Oct 2020 18:19:27 GMT

GET
H2 200 nr-1184.min.js Show response
js-agent.newrelic.com/ 27 KB
11 KB 72ms
24ms Script
application/javascript 151.101.114.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1184.min.js
Requested by: Host: www.forcepoint.com
URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 780861f2ab29c0144055244696561fb0306c8cb3cb7f548f9105c763b0e91f77

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:27 GMT
content-encoding: gzip
x-amz-request-id: A21809B1C987C063
x-cache: HIT
status: 200
content-length: 10624
x-amz-id-2: 5/0iWHe8AbcxZN6Jo3BmJ2Q+tztfRSNwr+lcNTrsM79nJm6KurTN6rNwf14f8ELquc1TIDOjlf4=
x-served-by: cache-hhn4051-HHN
last-modified: Mon, 28 Sep 2020 16:34:45 GMT
server: AmazonS3
x-timer: S1603736367.276502,VS0,VE0
etag: "3d7f312be60d08a2568e311e4762f3af"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 32752

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
650 B 196ms
138ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=l6a6s&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Mon, 26 Oct 2020 18:19:27 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 556b1d6aebe88f80a16782f520a3eccb
x-transaction: 0083e4e6004b81ab
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
233 B 146ms
139ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=o3qcd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 18:19:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Mon, 26 Oct 2020 18:19:27 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 556b1d6aebe88f80a16782f520a3eccb
x-transaction: 006e9948000c42b9
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 index.html
js.driftt.com/deploy/assets/ Frame C464 0
0 64ms
61ms Document
text/html 65.9.190.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/index.html

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1603736400000/bt3rzfauhdaf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.190.46 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /deploy/assets/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 894
server: nginx
last-modified: Tue, 13 Oct 2020 15:05:22 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 26 Oct 2020 18:19:27 GMT
etag: "e6bb65f85e419beda3231798abde6eb3"
cache-control: max-age=10
x-cache: Hit from cloudfront
via: 1.1 35262001a2ae8da534143b9a1e14d8fe.cloudfront.net (CloudFront)
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: iU6u9h1vDU1TrPt01U_MOmNrGYRjGiO-OEOeQL47kvLoqyZMP19R_Q==

GET
H/1.1 200
OK ab8aacbcff Show response
bam.nr-data.net/1/ 57 B
274 B 428ms
107ms Script
text/javascript 162.247.242.20
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/ab8aacbcff?a=452344952&v=1184.ab39b52&to=M1NVYEFVXUQCUU1cDAoZdldHXVxZTEJYUgY7W1ZaUlNWRTxcVlEGO0BeUURrQ1YEVw%3D%3D&rst=5339&ck=1&ref=https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks&ap=2499&be=2914&fe=5070&dc=3782&perf=%7B%22timing%22:%7B%22of%22:1603736362146,%22n%22:0,%22r%22:0,%22re%22:212,%22f%22:212,%22dn%22:212,%22dne%22:212,%22c%22:212,%22ce%22:212,%22rq%22:213,%22rp%22:2897,%22rpe%22:2902,%22dl%22:2902,%22di%22:3781,%22ds%22:3781,%22de%22:3826,%22dc%22:5069,%22l%22:5070,%22le%22:5275%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=3165&fcp=3791&at=HxRWFglPTko%3D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1184.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.20 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS: bam-8.nr-data.net
Software: /
Resource Hash: d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 57
Content-Type: text/javascript;charset=ISO-8859-1

GET
H2 200 index.html
ws.sharethis.com/secure5x/ Frame AF80 0
0 24ms
24ms Document
text/html 2600:9000:20d7:5c00:3:c04e:c780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.sharethis.com/secure5x/index.html
Requested by: Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/async-buttons.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:5c00:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash

Request headers

:method: GET
:authority: ws.sharethis.com
:scheme: https
:path: /secure5x/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks

Response headers

status: 200
content-type: text/html
content-length: 4080
content-encoding: gzip
last-modified: Fri, 09 Oct 2020 19:01:02 GMT
server: nginx/1.16.1
x-robots-tag: noindex, nofollow
date: Sun, 25 Oct 2020 21:43:27 GMT
etag: "5f80b36e-390f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 38a3f663851a0597e7026100a58b9b39.cloudfront.net (CloudFront)
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: J4GJfz7ckk5YgfgxMz08_49nADnRxPZufQbq9BexE1waTI7KLBAeIA==
age: 74161

POST
H/1.1 200
OK ab8aacbcff Show response
bam.nr-data.net/events/1/ 24 B
185 B 108ms
107ms XHR
image/gif 162.247.242.20
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/ab8aacbcff?a=452344952&v=1184.ab39b52&to=M1NVYEFVXUQCUU1cDAoZdldHXVxZTEJYUgY7W1ZaUlNWRTxcVlEGO0BeUURrQ1YEVw%3D%3D&rst=15339&ck=1&ref=https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.20 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS: bam-8.nr-data.net
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
content-type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.forcepoint.com
Access-Control-Allow-Credentials: true
Content-Length: 24
Content-Type: image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 6634a5cdf59e4bb3a8f70dcd111da346.events.ubembed.com
URL: https://6634a5cdf59e4bb3a8f70dcd111da346.events.ubembed.com/embeddableActivated?activationRuleId=e1ec7b350af345e7a26de58fdfd63621&browserTrackingId=2e6c12f3959f41f8a61a8be180861d04&clientId=0697aaa2-7db1-4806-bdbe-2c5e03a483aa&hostPageCorrelationId=50d407f58a68437e81b123230c98038e&hostPageReferrerUrl=&hostPageUrl=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&isFirstTime=true&requestId=00b11c5094144bb085a30643af228dc4&source=universalscript-v0.178.1

Verdicts & Comments Add Verdict or Comment

213 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.theadex.com/	1970-01-19 15:38:32	Name: tis Value: EP14%3A2605%7CEP2%3A2605
.forcepoint.com/	1970-01-19 13:28:58	Name: v18 Value: fp%3Ablog%3Ax%20labs%3Azeus%20delivered%20deloader%20defraud%20customers%20canadian%20banks
.forcepoint.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.forcepoint.com/	1970-01-19 22:14:32	Name: _biz_pendingA Value: %5B%5D
www.forcepoint.com/	1970-01-20 07:00:04	Name: driftt_aid Value: 449b129c-4325-4a4f-a523-c4475c936666
www.forcepoint.com/	1970-01-19 15:38:32	Name: axd Value: 4241747781479856255
www.forcepoint.com/	1970-01-19 15:38:32	Name: cmp Value: 7011G000000Y7cM
.forcepoint.com/	1970-01-20 07:00:08	Name: s_ecid Value: MCMID%7C09070401241205107793177902585707957365
.forcepoint.com/	1970-01-20 07:00:04	Name: AMCV_8DC067C25245AFA80A490D4C%40AdobeOrg Value: 281789898%7CMCIDTS%7C18562%7CMCMID%7C09070401241205107793177902585707957365%7CMCAAMLH-1604341166%7C6%7CMCAAMB-1604341166%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1603743566s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18569%7CvVersion%7C4.1.0
.forcepoint.com/	1969-12-31 23:59:59	Name: AMCVS_8DC067C25245AFA80A490D4C%40AdobeOrg Value: 1
www.forcepoint.com/	1969-12-31 23:59:59	Name: BIGipServerabmweb-nginx-app_https Value: !xvbr1LW8ACf4aKRybf/nLIVwOTHiDv3+ud9ymExldw25rZpTKxuCmdlbNdTwYxSLRyGSUSHE3WX0+A==
.forcepoint.com/	1970-01-20 07:00:08	Name: _mkto_trk Value: id:018-NKF-008&token:_mch-forcepoint.com-1603736366472-74347
.theadex.com/	1970-01-19 15:38:32	Name: axd Value: 4241747781479856255
.forcepoint.com/	1970-01-19 22:14:32	Name: _biz_nA Value: 2
.forcepoint.com/	1970-01-19 13:28:58	Name: _biz_sid Value: 92f22e
.forcepoint.com/	1970-01-19 13:28:56	Name: _gat_tealium_0 Value: 1
.forcepoint.com/	1970-01-19 22:14:32	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22Ecid%22%3A%22678850121%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
www.forcepoint.com/blog/x-labs	1969-12-31 23:59:59	Name: DriftPlaybook Value: A
.forcepoint.com/	1970-01-19 15:38:32	Name: _gcl_au Value: 1.1.1687383348.1603736366
.forcepoint.com/	1970-01-19 22:14:32	Name: utag_main Value: v_id:01756622ecad0015ae32adfc963300078005f07000b08$_sn:1$_ss:1$_st:1603738166254$ses_id:1603736366254%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:forcepoint.com
.forcepoint.com/	1970-01-19 22:14:32	Name: _biz_uid Value: 0061379a39254c53eeb2bed17203de9f
.forcepoint.com/	1970-01-19 13:30:22	Name: _gid Value: GA1.2.557428824.1603736366
.demdex.net/	1970-01-19 17:48:08	Name: demdex Value: 04666446448492738122807294436445648538
.forcepoint.com/	1970-01-19 15:38:32	Name: _vwo_ds Value: 3%3Aa_0%2Ct_0%3A0%241603736365%3A98.10260976%3A%3A%3A4_0%2C3_0%3A0
.forcepoint.com/	1970-01-19 13:28:58	Name: _vwo_sn Value: 0%3A1
.forcepoint.com/	1970-01-19 15:38:32	Name: _fbp Value: fb.1.1603736366462.1721142792
.forcepoint.com/	1970-01-23 05:04:56	Name: _vwo_uuid Value: DE66A31504E6F62AE56DB36B0124894A9
.forcepoint.com/	1970-01-19 15:52:56	Name: _vis_opt_s Value: 1%7C
.forcepoint.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
www.forcepoint.com/	1969-12-31 23:59:59	Name: has_js Value: 1
.forcepoint.com/	1970-01-20 07:00:08	Name: _ga Value: GA1.2.1198574995.1603736366
.forcepoint.com/	1970-01-19 22:15:58	Name: _vwo_uuid_v2 Value: DE66A31504E6F62AE56DB36B0124894A9\|6d0060fb0c407e7069711fd85d48fd3f

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js(Line 2) Message: start VWO sync section
console-api	log	URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js(Line 5) Message: VWO load https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=371490&url=https%3A%2F%2Fwww.forcepoint.com%2Fblog%2Fx-labs%2Fzeus-delivered-deloader-defraud-customers-canadian-banks&random=0.7388250987686635
console-api	log	URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js(Line 9) Message: VWO loaded
console-api	log	URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks(Line 87) Message: VWO load https://d5phz18u4wuww.cloudfront.net/vis_opt.js
console-api	log	URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks(Line 87) Message: VWO top initialize
console-api	log	URL: https://www.forcepoint.com/blog/x-labs/zeus-delivered-deloader-defraud-customers-canadian-banks(Line 87) Message: VWO bottom initialize
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 23) Message: [Facebook Pixel] - Duplicate Pixel ID: 168348421119586.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' data: 'unsafe-inline' 'unsafe-eval' .fonts.net analyticsssl.forcepoint.com .licdn.com .tiqcdn.com .marketo.com .marketo.net .mktoresp.com .demdex.net .burly.io .omtrdc.net .llnwd.net .tealiumiq.com .googleadservices.com .marinsm.com .amazonaws.com .quantserve.com .facebook.net .serving-sys.com .google-analytics.com .hirebridge.com .websense.com .bizographics.com .linkedin.com .cloudfront.net .newrelic.com .nr-data.net .adnxs.com .demandbase.com .twitter.com .omtrdc.net .youtube.com static.ads-twitter.com .company-target.com .omniture.com .doubleclick.net .forcepoint.com .google.com .facebook.com bam.nr-data.net maps.gstatic.com .getsmartcontent.com .vidyard.com .adroll.com s.ml-attr.com attr.ml-api.io .driftt.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .gstatic.com .libsyn.com .s3.amazonaws.com .cdnbasket.net ids.cdnwidget.com app.vwo.com .visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .googleapis.com .cloudflare.com activitymap.adobe.com .consensu.org .ubembed.com .bizible.com dmp.theadex.com tag.aumago.com; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' pixel.cdnwidget.com .tealiumiq.com .google.com .googleadservices.com .doubleclick.net .websense.com .marinsm.com .facebook.com .quantserve.com .google-analytics.com .w55c.net .marketo.com .iasds01.com .linkedin.com .cloudfront.net .forcepoint.com .adnxs.com .twitter.com t.co .omtrdc.net tags.w55c.net .demandbase.com .company-target.com maps.gstatic.com tags.tiqcdn.com munchkin.marketo.net .newrelic.com connect.facebook.net static.ads-twitter.com a.burly.io sjs.bizographics.com bam.nr-data.net snap.licdn.com https://websense.tt.omtrdc.net/m2/websense/mbox/json .getsmartcontent.com .adroll.com .vidyard.com s.ml-attr.com attr.ml-api.io ml314.com .ml314.com .bing.com .driftt.com .crazyegg.com .sharethis.com .vimeo.com .slideshare.net .techvalidate.com .gartner.com .googletagmanager.com .visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com app.vwo.com .js.ubembed.com assets.ubembed.com js.driftt.com cdn.vwo-analytics.com .s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io .clearbit.com .googleapis.com .cloudflare.com https://activitymap.adobe.com/sc15/activitymap/index.js .consensu.org .bizible.com dmp.theadex.com tag.aumago.com ws.zoominfo.com; img-src data: ; connect-src 'self' app.vwo.com dpm.demdex.net websense.tt.omtrdc.net .mktoresp.com .cdnbasket.net ids.cdnwidget.com .forcepoint.com sample-api-v2.crazyegg.com .visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net .tealiumiq.com live-evercurrent-clone.pantheonsite.io .sharethis.com .doubleclick.net dmp.theadex.com tag.aumago.com google-analytics.com; report-uri /admin/config/system/seckit/csp-report
Strict-Transport-Security	max-age=18410000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

018-nkf-008.mktoresp.com
6634a5cdf59e4bb3a8f70dcd111da346.events.ubembed.com
6634a5cdf59e4bb3a8f70dcd111da346.js.ubembed.com
6634a5cdf59e4bb3a8f70dcd111da346.pages.ubembed.com
ajax.googleapis.com
analytics.twitter.com
analyticsssl.forcepoint.com
assets.ubembed.com
attr.ml-api.io
bam.nr-data.net
c.sharethis.mgr.consensu.org
cdn.bizible.com
cdn.bizibly.com
cdnjs.cloudflare.com
cm.everesttech.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
d5phz18u4wuww.cloudfront.net
dev.visualwebsiteoptimizer.com
dmp.theadex.com
dpm.demdex.net
i.imgur.com
js-agent.newrelic.com
js.driftt.com
l.sharethis.com
munchkin.marketo.net
nextroll.com
platform.twitter.com
px.ads.linkedin.com
s.adroll.com
s.ml-attr.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.tiqcdn.com
websenseinc.demdex.net
ws.sharethis.com
ws.zoominfo.com
www.facebook.com
www.forcepoint.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
6634a5cdf59e4bb3a8f70dcd111da346.events.ubembed.com
104.109.95.62
104.111.215.136
104.244.42.3
104.244.42.5
143.204.208.228
151.101.112.157
151.101.112.193
151.101.113.131
151.101.114.110
162.247.242.20
18.185.151.20
18.196.95.178
185.33.220.145
192.28.144.124
2600:9000:20d7:5c00:3:c04e:c780:93a1
2600:9000:20d7:e800:c:a9b7:ddc0:93a1
2606:2800:234:59:254c:406:2366:268c
2606:4700::6810:125e
2606:4700::6810:a852
2620:1ec:22::14
2a00:1450:4001:803::2004
2a00:1450:4001:80b::200a
2a00:1450:4001:818::2003
2a00:1450:4001:824::2008
2a00:1450:4001:824::200e
2a00:1450:400c:c00::9c
2a02:26f0:10c:582::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42::740
2a05:f500:11:101::b93f:9005
3.248.78.233
34.96.102.137
35.181.18.61
52.0.105.155
52.30.191.169
54.171.28.113
65.9.190.35
65.9.190.46
66.117.28.86
68.232.35.12
68.67.153.60
89.163.159.104
95.101.184.154
99.86.2.95
013ace7c7bd3d1defdf1f0929013e3209ce060859301e5c87cb237220de141e8
04024f7bc306691563fe715ae09ec38788d131385603101fd717a84d485f6b03
04370a2d475c78b1551f863e340a8672d13754d94bb68eec6b15b589733bd20f
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0cd76c0e7ab206f138acc0c00c8909b344ebeecd07986a950e1b7632eedca1cb
0ec291adef932c1e26510f560daef99d2d26b96331cbfd2f29fe234eaf2dddae
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
13307a4188344f0e50223b975d45f37af16ff6fce216b7e3fb2252d16e51467a
1493f7f51959732ad8cec8f45b24bc11773637f74c9bf47a1a23f66b47d595b6
152d33f581c1bd7b2a423e3e2fa1a2c34817751298e0829bc4154f9e04844baa
16089a42741acc5fd00ab17da92be9458e8f0029fd645f159e582a7ea0f52ec1
178c0cef22122f076e0bd80e16ed1cfbcf9bfe317b4c29f63e69fce067b93887
1a5c0fb755eabd84fa9ee65115561abfc934cb67631d8392acc299bed349942d
1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3
204265a6f1fc8529e4a64cff2c17c04709b46455f93003d24edb50bd78977223
29aebe811bb2f84bd90cfdee7ffc4c4af62bb5d871fd683f8a85bf0852ce9163
2a7b733b2f19d538893df08b2c194aef1201dbad6ee2ddafc5bcd34cbb482d6b
2d6b3f3c5ff369d4df14f16820d8300a5c57ea938bc1f932421a5d6241f9e568
2ea444232041ca2742d6fa16436771e31bd9871c72b5ecc2850040509b12f5af
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
325914d019287f222e9458ede59e620e3f5c581a5d30b24e7786e78e2f5f8f10
390521e00071f213b9c2037f0a536269e06950b4d9a45f63f71910d3e3bb790b
396f21e0bf03d975ede7ee6d0f68c3d98641ac35374b1f6797e3f1b790c9f13f
397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b
3bf68fd8998873a2885f9a5e2baccf393024fa7ebb9e992aa260dfe542e1aea0
4634aac322fc2a16b04c959664ad321462df9360682556e381341d489c1326cd
483b45552b36368e93721f70777d2fc7c793cffda42afd38dbfa6281694e231e
4c77b84665a1e6bfb24ec928a1ed9045818099f6a6f2e26e2bb22a560067183f
4d1a17044b0075f8f1089bfe74833f44697cb61e60c86287e8a191516abaa853
4e2a8b16a227605843bcf04d32557fa5f790d17d5fae10db399f3ad6b75cae70
51005d3e85613d1bca816179264b86b7b646ad3ff5a36f1ed3d90d37bdfb22ec
519be4598150ebd07de7df2af974a5928f956f617b4cecb376181f34bf7b1df6
527ce22593bfcd6e20caa955f7f3ee14538001d5077c5f24d3bd52a31b36dd34
52de4f853e32cbad1473948b54b45888a76d70bc156a906a4e90d3fe9d63384f
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a1a1ccce193736380d92b310e6c721d7d727d3f5a7efca350606428827a489a
5a3a0313429b22b8fd7b067a306c2733e73b8a1e038591f722ad524e9f60ab79
5b26abbdb273ae2b78aa51fc484ceade76b355c124a78ef2a13bba032aba21c1
5c08480aacf1854cb0c6f5030ea1b72c953b89e3be8029698556df5703a4085a
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5e0be93fbb1f5666aa2b3d590684e4e4d13146da5856dd2a5794f0ba8e321b8e
606b1457709eeda5c12414b6dffbf91ce13f13942fc970d785806efd7ee734d5
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6116382548abaad3d6133a60e2dc187d88dfa1ed07d981311c0bbcfaee05cd49
6408a837784b4b1e5bdce4b19d2bb4ff1c08c63eaebfe028bd91a559e7eceb8c
6676353d7029b44112419ac26efd665e84021eb418ccf05a1e1f04d0ba46bd53
6c83e5d7f0ded3288239450241b35c47335da6e5ed9d1cb87e2914039ae44da5
6d9a7fd96a3f724833b9b68c20877b5701f64df5446138733baec495138cfb3b
705625f67416c089ec12f98067511c51064b70b57ee1241ba675a1030d26213c
77bfa66bf799ef1d5be3e464795aaca2f9a0587c1616b9671f7383623474f455
780861f2ab29c0144055244696561fb0306c8cb3cb7f548f9105c763b0e91f77
79673753d63f34d0e4d8fcec94babbf043b27387bd7767d0ba8c354f3642a54c
7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7
7c7037514836388334db2f123a214f7ec133481a2d7d128adb62693b5ce9dcef
7cfa42d2fdc91cf59d03d7558e4d951dbb62ad4a1fa8b7ef6871159e6328cdce
7da0540e0b536da199335da765f4aa358878f41b295d64fea84e1ee7ae5c73ca
7da3716d9946f2c609d488aa7c55e83935149ce4cdce0e7d80030aa663b8dc3d
7fc6a0616e0a7cf3b8abaa2ab6a02147601829c741de3c870ab3df86aec4af5c
8209afd835a4210dbc2b46fea7d483434266a4a465c485ee9fdca694799133f2
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8275ce62ba23473ad2cf760b9ac237a235261d5d38523c26d32ed4f48d4d2492
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
887691af38c1c894440f9faea8cafd39f8f742cc1b9a08d59759bd16babdf1d2
8892ffd9b6812e96fca28cf2b24a4a1e25711631d73141353f1ec57fcaf523b8
88a9f854838d4933c158c0b65f9e855992a05790931fdd5e588f637cb82d07c6
89f73af23bcadce2d0605735149c8a7ce2586cfcb9db7a158521b1ed9139e69e
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8c3f0e9b32d6de9794c58be0c1f01fd729a47d4d4cba1da3ef7366bb282564a1
8d840af08b18a0a99928ebbbb9a0b4263e08631c0177a3c74963c0e9056c3a21
8f1993495d96383b5fd34d2f942fd512e285ec3eaeb0108f6e21bfd45b3a49e6
9013ff56b3eb7dacea9886c26ddead020a8cd81822f40ead55df95b779941b14
912856e113e646cb59dd2a480be66f5463455408b458432e0a7234664608685c
913a3d6d72df757623fc7a1ef37ef84e60ffbff83cb9514aa01a39db05f7bee4
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9483d84c3dbce2446506011035e4135b87b44657eed947acd345faa338521004
95dc1b83a7c030dd13ab3e29df921f10e04208b28734f172ea232854264c3b05
95fa06fca5253dd4347dc57fc0cea541dc25d8fa30771904c1d00fa695603dbd
98c26f5c930391ad6bd544218212ffbe8e1e7f2025966993ccf3758a7714ed1a
9bf02c9770b2f6cca2e8995e99c09c07ef6f970d78f11912f924056a3eaa44e3
9cc77ec166565cf138f088e29b263d7de28ebff89c6ac6ac7b3226b8c2c45f33
9d15898503a42b662e23214cd7b80ea6c1758596cae92b51509d5a752f71cf66
a1ac3d755b387c28943563b82db22d874a1b192ba8119a4bc3f1697a2a7e258b
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a51ccbe50d3e48a6dbfab565c9cd32eb148afb8134890b8437fb85c2b09d0c74
a5801778ff84312987440fe98294960b5b514a764ce5cd09cd6afcffcf38862f
a793b9a0507f90f79bb2f91d160962842e4b9aeb48e1475438cdae3717e3834e
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
af60288a11ae9864cdd707a9c6e13463359d5ffb6755bf9035a878f18b8758f9
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b48339180c7ef70a3737ad1bc0a8c24f96878ed162a819bc44f5895f8b5c548e
b5c2800c52737f3425d0e434c93f9412da5e0491282c8d3d53b4d707202b8cef
b69c8458f5ca5c3f09345eed4b8ba858149eec0c99db74a01e860f6e5b5968af
b80a71bbfd599367ed06d6cd8a59d87bf0b02aafde9b20b1554abcfbf00abae3
ba206ae667f1642cd0a35950bee63b5f3df2a147d04272a5f3aba7e2d53167aa
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
c0c810909068da447ca522f9770490722119d254f18905ae37e5e4a45e2c346c
c0e0b9f64e6354a2677f8cc7b48c489b4fac6183a86dfedc0f52bb0cc17fce3a
c181c648e71e1f94dc9f3aa0aced539df9790bc1aa92494d7fe7b17c274767bf
c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59
c4025a9cc2ee1aaeb9564fe989116a81f23e5368d2ed6f9c085183e0edf6bc93
c499b1afa176ed0e1222b897f02152b5355a22e0d403eaf0f2759838ee844234
c6a4f005d0158d27d475991d4606ec4141f42917cc68835019d819c583957710
c7397ae13ad9d12bf4ce9100756dd8703b515ac4381bdd33638e22c787c0fb39
cb5d792f92a7b7dfcf66898fe8b5597b10a5f04dd9b83c848711401ebc0bd5f6
cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d
ce35f2450851af5e3b8e502f29a7048c7da4b7474061493711a15becf6fd7e0b
cf401f0aec11d24c5272997dcb1ffb78c55df70499a70c7f0863b91e215a592b
d0b790fc60c934512442fccae90a7ad9f74471945f9d480f5f04736e41813f9a
d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1
d7abcb6ab268068a893726c4dca77b84fefbca4be2c86440bc1d4a4f6e5569d7
dd0779c9ae69f9d8cd8728663703ce2cc6ec972dc5350a5f6948a15d67fbeea9
dd3989fea51741ca2df9b9d4322db02d378098b5dcca8342a0209a79eadf8933
de0c91884c0f70a3c8ab477b2637d9c9417fc74eb663bbe6eace7836e8b38fc3
df25786bc3951d78d0f763a2a75a1f33b01b8ae2a5157831d2cf4d0348c2ede7
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
dfc5564378e3431d304458fb8249ed66bd3bec6809a069f99efdefd3921e2cba
e07620fe04b0512241b54d21ef6be73105f3da02d9590fffc0d14dde31505b09
e29d9249450c34c94e78ea24e50f48a0921d5403c584539c7f841a18952a12f7
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3a5e17dd26ebd37ea990a2591a24b1bf8da5bf6f42ddb185abcb5b14674a9bd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52e36134236de5bc2ed14fae433aeb6c3e22964df2ee8645c05acbbbd80bec0
e662822f90ea34690370a8dfa7a5c01673e833247c84834c51b64c3dbabf596d
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
e96ee4202dd697f4757a0c1502f5b3ae79c0d59d0823d80a80ac3ed97132d861
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f410972f63cd7a3e72bced8a9d9e5853ce3a68f814d1f3f9750a71fb140d7ec3
f4cbc6a70cd3d48475ddbb975d3831d02e4158a76fcdb997891baa497ea31241
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f6111a2b70adc74b366e13097ef3bc968003d16bbebbd72d324cdb73edb32c36
f69f0d278008c3c2ec3ab8a9ec6fc5725a9630daa745775f0da9b8c390167b32
fe1204692b14773ce1f8a8b10ca5334c73331ef62739c0165e9877e5e89b62d3

www.forcepoint.com Open in urlscan Pro 2a04:4e42::740 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

142 Requests

99 %HTTPS

38 %IPv6

38 Domains

48 Subdomains

41 IPs

7 Countries

2158 kBTransfer

6065 kBSize

32 Cookies

10 Outgoing links

Page URL History

Redirected requests

142 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 21 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.forcepoint.com Open in urlscan Pro
2a04:4e42::740 Public Scan

Screenshot
Live screenshot

Full Image

142
Requests

99 %
HTTPS

38 %
IPv6

38
Domains

48
Subdomains

41
IPs

7
Countries

2158 kB
Transfer

6065 kB
Size

32
Cookies

142 HTTP transactions
21 data transactions