URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-like...
Submission: On June 24 via api from TR — Scanned from DE

Summary

This website contacted 28 IPs in 5 countries across 21 domains to perform 103 HTTP transactions. The main IP is 141.193.213.21, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.securonix.com.
TLS certificate: Issued by E1 on April 29th 2024. Valid for: 3 months.
This is the only time www.securonix.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
39 141.193.213.21 209242 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
9 172.67.39.148 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:310... 13335 (CLOUDFLAR...)
10 95.100.98.18 20940 (AKAMAI-ASN1)
1 2a04:4e42:600... 54113 (FASTLY)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
1 6 2600:9000:264... 16509 (AMAZON-02)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
3 18.245.86.77 16509 (AMAZON-02)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 142.250.184.227 15169 (GOOGLE)
1 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a05:d018:cc3... 16509 (AMAZON-02)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
2 76.223.9.105 16509 (AMAZON-02)
2 18.245.86.73 16509 (AMAZON-02)
3 104.18.37.212 13335 (CLOUDFLAR...)
4 104.16.118.43 13335 (CLOUDFLAR...)
1 104.16.117.43 13335 (CLOUDFLAR...)
103 28
Apex Domain
Subdomains
Transfer
39 securonix.com
www.securonix.com
4 MB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5903
c.6sc.co — Cisco Umbrella Rank: 8340
ipv6.6sc.co — Cisco Umbrella Rank: 6045
b.6sc.co — Cisco Umbrella Rank: 3852
21 KB
9 addtoany.com
static.addtoany.com — Cisco Umbrella Rank: 4733
33 KB
7 adroll.com
s.adroll.com — Cisco Umbrella Rank: 3747
d.adroll.com — Cisco Umbrella Rank: 1811
119 KB
5 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 5175
ws-assets.zoominfo.com — Cisco Umbrella Rank: 14358
30 KB
5 driftt.com
js.driftt.com — Cisco Umbrella Rank: 7548
71 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 360
px4.ads.linkedin.com — Cisco Umbrella Rank: 6416
2 KB
3 zi-scripts.com
js.zi-scripts.com — Cisco Umbrella Rank: 7464
4 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 361
14 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 81
297 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9419
729 B
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 1008
4 KB
2 formhq.net
embed.formhq.net — Cisco Umbrella Rank: 181883
4 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
ajax.googleapis.com — Cisco Umbrella Rank: 469
32 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 8088
63 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 136
256 B
1 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3125
256 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 902
14 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381
3 KB
1 gstatic.com
fonts.gstatic.com
50 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 268
2 KB
103 21
Domain Requested by
39 www.securonix.com www.securonix.com
9 static.addtoany.com www.securonix.com
static.addtoany.com
8 b.6sc.co www.securonix.com
6 s.adroll.com 1 redirects www.googletagmanager.com
www.securonix.com
s.adroll.com
5 js.driftt.com www.securonix.com
js.driftt.com
4 ws.zoominfo.com js.zi-scripts.com
ws-assets.zoominfo.com
3 js.zi-scripts.com www.securonix.com
js.zi-scripts.com
3 px.ads.linkedin.com 1 redirects snap.licdn.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.securonix.com
3 www.googletagmanager.com www.securonix.com
www.googletagmanager.com
2 epsilon.6sense.com j.6sc.co
2 unpkg.com 1 redirects www.securonix.com
2 embed.formhq.net www.googletagmanager.com
embed.formhq.net
1 ws-assets.zoominfo.com js.zi-scripts.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 d.adroll.com s.adroll.com
1 px4.ads.linkedin.com www.securonix.com
1 www.google.de www.securonix.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 cdn.jsdelivr.net www.securonix.com
1 j.6sc.co www.securonix.com
1 fonts.gstatic.com fonts.googleapis.com
1 ajax.googleapis.com www.securonix.com
1 cdnjs.cloudflare.com www.securonix.com
1 fonts.googleapis.com www.securonix.com
103 28
Subject Issuer Validity Valid
www.securonix.com
E1
2024-04-29 -
2024-07-28
3 months crt.sh
upload.video.google.com
WR2
2024-06-03 -
2024-08-26
3 months crt.sh
cdnjs.cloudflare.com
E1
2024-06-02 -
2024-08-31
3 months crt.sh
static.addtoany.com
E5
2024-06-21 -
2024-09-19
3 months crt.sh
*.google-analytics.com
WR2
2024-06-03 -
2024-08-26
3 months crt.sh
*.gstatic.com
WR2
2024-06-03 -
2024-08-26
3 months crt.sh
formhq.net
E1
2024-04-29 -
2024-07-28
3 months crt.sh
6sc.co
R3
2024-04-09 -
2024-07-08
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3
2023-09-27 -
2024-10-28
a year crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 04
2024-06-19 -
2024-12-16
6 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
s.adroll.com
Amazon RSA 2048 M02
2024-05-03 -
2025-06-01
a year crt.sh
drift.com
Amazon RSA 2048 M02
2023-08-15 -
2024-09-11
a year crt.sh
*.g.doubleclick.net
WR2
2024-06-03 -
2024-08-26
3 months crt.sh
*.google.de
WR2
2024-06-03 -
2024-08-26
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-01-30 -
2024-07-30
6 months crt.sh
d.adroll.com
Amazon RSA 2048 M01
2023-10-09 -
2024-11-07
a year crt.sh
*.6sense.com
Amazon RSA 2048 M03
2024-03-31 -
2025-04-29
a year crt.sh
zi-scripts.com
GTS CA 1P5
2024-05-27 -
2024-08-25
3 months crt.sh
zoominfo.com
E5
2024-06-17 -
2024-09-15
3 months crt.sh

This page contains 4 frames:

Primary Page: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Frame ID: 287AD36D4F30FA4BDC735E92E4AD841B
Requests: 97 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: DC5DA766C293D4C6E109E672048D7C75
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=83f1ee13-53d3-4817-a0bd-75a36c5d06f4&sessionStarted=1719195185.453&campaignRefreshToken=ba4519a7-f38d-4488-a3f4-8d79ef6e568f&hideController=false&pageLoadStartTime=1719195180052&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F
Frame ID: 6EF463B16BAC334530129D5683F07045
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1719195180052
Frame ID: 9B5C710EBCD14E3E0E9F2E34FF49A1B4
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Analysis of PHANTOM#SPIKE: Attackers Leveraging CHM Files to Run Custom CSharp Backdoors Likely Targeting Victims Associated with Pakistan - Securonix

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • addtoany\.com/menu/page\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

103
Requests

95 %
HTTPS

59 %
IPv6

21
Domains

28
Subdomains

28
IPs

5
Countries

5075 kB
Transfer

6826 kB
Size

19
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51
  • https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
  • https://unpkg.com/web-vitals@4.2.0/dist/web-vitals.iife.js
Request Chain 67
  • https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js
Request Chain 70
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1719195184737&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&tm=gtmv2 HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1719195184737&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&tm=gtmv2&e_ipv6=AQLa-jUpHiT7fAAAAZBIBK67ah8cX4m3zUTFgPTukJ4g04go_aCQu8GMBI2KaJPQ9gg2foDFriVn

103 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
128 KB
22 KB
Document
General
Full URL
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
d839cf18d046a45de925e9d3fbfb69a972d3e71da1e19f9584369e354adb74f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-edge-cache
cache,platform=wordpress
cf-ray
89893231c80e3a7c-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 24 Jun 2024 02:13:00 GMT
link
<https://www.securonix.com/wp-json/>; rel="https://api.w.org/" <https://www.securonix.com/wp-json/wp/v2/blog/29268>; rel="alternate"; type="application/json" <https://www.securonix.com/?p=29268>; rel=shortlink
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
HIT: 13
x-cache-group
normal
x-cacheable
SHORT
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
WP Engine
bootstrap.min.css
www.securonix.com/wp-content/themes/punch/styles/css/
0
0
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/themes/punch/styles/css/bootstrap.min.css?ver=3.3.2
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/html
cf-ray
89893235da8f3a7c-FRA
alt-svc
h3=":443"; ma=86400
style.css
www.securonix.com/wp-content/themes/punch/styles/css/
0
0
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/themes/punch/styles/css/style.css?ver=6.5.3
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/html
cf-ray
89893235da903a7c-FRA
alt-svc
h3=":443"; ma=86400
wpcdt-public.css
www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/
822 B
448 B
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/wpcdt-public.css?ver=2.5
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
09bfea7e712355726b2d97bf0a13a80f8f8e5e5834a13d666d1cea2bd3ab31a9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
284027
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:44 GMT
server
cloudflare
etag
W/"66334868-336"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235da913a7c-FRA
jquery.powertip.min.css
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/
2 KB
492 B
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/jquery.powertip.min.css?ver=1.2.0
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
1028540
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:44 GMT
server
cloudflare
etag
W/"66334868-70d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235da933a7c-FRA
maps_points.css
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/maps_points.css?ver=1.2.3
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a55a1504046635db1567af44c96b2a820151041a3d384726e32dad566684d899
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005719
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:44 GMT
server
cloudflare
etag
W/"66334868-1c2f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235da943a7c-FRA
default.css
www.securonix.com/wp-content/plugins/tablepress/css/build/
6 KB
2 KB
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/plugins/tablepress/css/build/default.css?ver=2.1.7
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c10bfd761676feda6e280e0d31794b1a8d21279f437ddb817a708d6fe0b72db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005720
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:41 GMT
server
cloudflare
etag
W/"66334865-17cb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235da963a7c-FRA
tablepress-responsive.min.css
www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/
9 KB
1 KB
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005720
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:41 GMT
server
cloudflare
etag
W/"66334865-22aa"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235da973a7c-FRA
addtoany.min.css
www.securonix.com/wp-content/plugins/add-to-any/
2 KB
600 B
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005720
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:49 GMT
server
cloudflare
etag
W/"6633486d-644"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235da983a7c-FRA
css2
fonts.googleapis.com/
2 KB
932 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
09ba5df6e121c4577cac7addaca7ab9f189e8c1afd745652396b05f8e45baf0a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Mon, 24 Jun 2024 02:13:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 24 Jun 2024 02:13:00 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 24 Jun 2024 02:13:00 GMT
select2.min.css
cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/
15 KB
2 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/select2.min.css?ver=1.2.51
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
907f4395f54e25a1da1181672f1a498e98b26f7bfc6dcb6c209a737472451e49
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
288059
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1676
last-modified
Tue, 26 May 2020 03:00:41 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5ecc8659-3dcf"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AEb68fcX5vk%2BdH%2F4Brm1I4mY1hVP5s6QWPlkcJU2HHfS%2BIHawfowQWMjTIAYAC52IC59FK3Oe7%2FlqM72f5B3G2S%2BoZxt9wHZPG2G6KqpCUj%2F%2B0sZXK%2F42hhARCFbD1kz8Fo%2BLyMZYi5LTnMo5IoYvQbB"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8989323828f43828-FRA
expires
Sat, 14 Jun 2025 02:13:00 GMT
single-common.css
www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/
19 KB
3 KB
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/single-common.css?ver=1.2.51
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
32f274178facd20384d11f4cf5d6cb7aa0d72c1a544da5d66a441d703030b518
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005096
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 31 May 2024 20:30:21 GMT
server
cloudflare
etag
W/"665a335d-4d8b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235da993a7c-FRA
avia-merged-styles-6292885bf0f081c03abe0eedd6656911---666a154b35074.css
www.securonix.com/wp-content/uploads/dynamic_avia/
129 KB
22 KB
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-6292885bf0f081c03abe0eedd6656911---666a154b35074.css
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b866f204d2a5b0fa88df426bfef64de132a4a2ef9cbb03bd42b46853b5f6747a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
959917
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 12 Jun 2024 21:38:19 GMT
server
cloudflare
etag
W/"666a154b-2025c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235eaa13a7c-FRA
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.1/
86 KB
31 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js?ver=3.4.1
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 18 Jun 2024 14:59:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
472438
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30774
x-xss-protection
0
last-modified
Mon, 13 May 2019 14:37:17 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 18 Jun 2025 14:59:02 GMT
library.js
www.securonix.com/wp-content/themes/punch/js/
0
0
Script
General
Full URL
https://www.securonix.com/wp-content/themes/punch/js/library.js?ver=6.5.3
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/html
cf-ray
89893235faab3a7c-FRA
alt-svc
h3=":443"; ma=86400
ajax.js
www.securonix.com/wp-content/mu-plugins/kmdg-framework//assets/js/
3 KB
1 KB
Script
General
Full URL
https://www.securonix.com/wp-content/mu-plugins/kmdg-framework//assets/js/ajax.js?ver=KMDG_FRAMEWORK_VERSION
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ba0dc4a2c348e233bb9d06d948ac25172b3dafbe04aac1692e925742fcf095a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005720
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:49 GMT
server
cloudflare
etag
W/"6633486d-bd5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893235faad3a7c-FRA
bootstrap.min.js
www.securonix.com/wp-content/themes/punch/js/
0
0
Script
General
Full URL
https://www.securonix.com/wp-content/themes/punch/js/bootstrap.min.js?ver=3.3.2
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/html
cf-ray
89893235faae3a7c-FRA
alt-svc
h3=":443"; ma=86400
page.js
static.addtoany.com/menu/
3 KB
2 KB
Script
General
Full URL
https://static.addtoany.com/menu/page.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e0cc78c402cbc02fdfd41cd77c5fd6ffbd8066cc07935ea8eb5f3fcc59744a3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
25248
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"e346c2841e4abbb66ee259e9540abb61"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xjq7QFbi12VLG54U%2Bjg5quy%2FqZWru17BHm6PirUOYF94VC2B7wKgRRo6Tq0MWiJPYNcOnO%2BzleFhfMH2CV3E8h8WUqGEd6QTErTt6AGLBVlmKbsyuCHSr1v00lL3d2%2BHGJuSTSjs"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400, stale-while-revalidate=30, public
cf-ray
8989323b08f5bb35-FRA
addtoany.min.js
www.securonix.com/wp-content/plugins/add-to-any/
129 B
474 B
Script
General
Full URL
https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2007262
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:49 GMT
server
cloudflare
etag
W/"6633486d-81"
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
8989323a3e3cbb8f-FRA
Securonix-logo.webp
www.securonix.com/wp-content/uploads/2024/04/
14 KB
14 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo.webp
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2bf92d09ea70e1745242a22e86adb8088bc17c61a744c2f3d984601f6bd4e423
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
1055938
alt-svc
h3=":443"; ma=86400
content-length
14448
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:30 GMT
server
cloudflare
etag
"6633485a-3870"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
89893235faaf3a7c-FRA
phantom_advisory_2.png
www.securonix.com/wp-content/uploads/2024/06/
387 KB
388 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/06/phantom_advisory_2.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7bb7cca3d35df9505bb0017fc721ca530db99fd3497e2bc991027e1edc532d84
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
44649
cf-polished
origFmt=png, origSize=624232
content-disposition
inline; filename="phantom_advisory_2.webp"
alt-svc
h3=":443"; ma=86400
content-length
396208
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100,h2pri
last-modified
Thu, 20 Jun 2024 22:14:52 GMT
server
cloudflare
etag
"6674a9dc-98668"
vary
Accept
x-frame-options
SAMEORIGIN
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
89893235fab03a7c-FRA
phantom_advisory_3.png
www.securonix.com/wp-content/uploads/2024/06/
1 MB
1 MB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/06/phantom_advisory_3.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
44fe36f267735fedc846090b255f109da041d2d02c0a6c5d9b218e493e8521ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400
content-length
1143730
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 20 Jun 2024 22:14:47 GMT
server
cloudflare
etag
"6674a9d7-1173b2"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
89893235fab13a7c-FRA
phantom_advisory_4.png
www.securonix.com/wp-content/uploads/2024/06/
457 KB
458 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/06/phantom_advisory_4.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cedfecc02e225c12e1b25ee4f3927b630dbe1daab8b505146d25681f458b5c73
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
44648
cf-polished
origFmt=png, origSize=721914
content-disposition
inline; filename="phantom_advisory_4.webp"
alt-svc
h3=":443"; ma=86400
content-length
468170
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100,h2pri
last-modified
Thu, 20 Jun 2024 22:14:43 GMT
server
cloudflare
etag
"6674a9d3-b03fa"
vary
Accept
x-frame-options
SAMEORIGIN
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
898932381bcabb8f-FRA
phantom_advisory_5.png
www.securonix.com/wp-content/uploads/2024/06/
297 KB
298 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/06/phantom_advisory_5.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8f703bd94ac5b9388b21eb31b10373e456985857de57b6fd5ba93d24816c97f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
44648
cf-polished
origFmt=png, origSize=493068
content-disposition
inline; filename="phantom_advisory_5.webp"
alt-svc
h3=":443"; ma=86400
content-length
304140
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100,h2pri
last-modified
Thu, 20 Jun 2024 22:14:39 GMT
server
cloudflare
etag
"6674a9cf-7860c"
vary
Accept
x-frame-options
SAMEORIGIN
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
89893238cca5bb8f-FRA
phantom_advisory_6.png
www.securonix.com/wp-content/uploads/2024/06/
592 KB
592 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/06/phantom_advisory_6.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9e7815ab9e019401e239b040cd31eb6870c6d2ebf30417f47b8ad18e955a908
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400
content-length
606195
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 20 Jun 2024 22:14:36 GMT
server
cloudflare
etag
"6674a9cc-93ff3"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
8989323a3e40bb8f-FRA
phantom_advisory_7.png
www.securonix.com/wp-content/uploads/2024/06/
586 KB
586 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/06/phantom_advisory_7.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c93626ad32b3449b19ebd9c7e5dfa53947c8ed99ede81a422b146ac6da791fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400
content-length
599627
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 20 Jun 2024 22:14:32 GMT
server
cloudflare
etag
"6674a9c8-9264b"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
8989323a3e43bb8f-FRA
global.js
www.securonix.com/wp-content/themes/punch/js/
0
0
Script
General
Full URL
https://www.securonix.com/wp-content/themes/punch/js/global.js?ver=6.5.3
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/html
cf-ray
898932397d5bbb8f-FRA
alt-svc
h3=":443"; ma=86400
jquery.powertip.min.js
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/
11 KB
4 KB
Script
General
Full URL
https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/jquery.powertip.min.js?ver=1.2.0
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
1055939
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:44 GMT
server
cloudflare
etag
W/"66334868-2ae5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
898932399d79bb8f-FRA
maps_points.js
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/
628 B
699 B
Script
General
Full URL
https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/maps_points.js?ver=1.2.3
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0230904fa157dff50d8ecc1a80a203635fa812479f4432a69c3779986ab560e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005720
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:44 GMT
server
cloudflare
etag
W/"66334868-274"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893239fdd0bb8f-FRA
new-tab.js
www.securonix.com/wp-content/plugins/page-links-to/dist/
34 KB
13 KB
Script
General
Full URL
https://www.securonix.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.7
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dceecf8eaa03968e40b767206be8a36a13d7444557fced227454ae4f100e5c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005720
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:44 GMT
server
cloudflare
etag
W/"66334868-8687"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
8989323a3e32bb8f-FRA
smush-lazy-load.min.js
www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/
8 KB
4 KB
Script
General
Full URL
https://www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.16.2
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bdcc9e3e427ad3a787ec7efe46d8c305e880eb44402c0000ff52f17ef6b0cdb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005719
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:40 GMT
server
cloudflare
etag
W/"66334864-2018"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
8989323a3e37bb8f-FRA
dropdown.js
www.securonix.com/wp-content/plugins/gtranslate/js/
13 KB
5 KB
Script
General
Full URL
https://www.securonix.com/wp-content/plugins/gtranslate/js/dropdown.js?ver=6.5.3
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3fcc408630bdf993595abbcc2a7ace8a55058dd7a3107236a68cd76a690e1ae9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
272343
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:44 GMT
server
cloudflare
etag
W/"66334868-326d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
8989323a3e46bb8f-FRA
avia-footer-scripts-580cdc29960fb4a0f1ab0c8168a4daf0---666a154c5d79c.js
www.securonix.com/wp-content/uploads/dynamic_avia/
12 KB
3 KB
Script
General
Full URL
https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-footer-scripts-580cdc29960fb4a0f1ab0c8168a4daf0---666a154c5d79c.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ebb2ce2e9e5c77cc2c4081b2d88c1f10d471b0f9b440e672465d276f507273a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
961602
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 12 Jun 2024 21:38:20 GMT
server
cloudflare
etag
W/"666a154c-31a1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
8989323a3e3abb8f-FRA
bebb17ee-495c-4095-822e-257c0ec0f8dc
https://www.securonix.com/
1 KB
0
Other
General
Full URL
blob:https://www.securonix.com/bebb17ee-495c-4095-822e-257c0ec0f8dc
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
1185
Content-Type
text/javascript
gtm.js
www.googletagmanager.com/
323 KB
108 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2b0eefb585a8e3a1a8e2b60d258efd22af0847adb3a09c26d66104b151464fb9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
110155
x-xss-protection
0
last-modified
Mon, 24 Jun 2024 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 24 Jun 2024 02:13:01 GMT
truncated
/
37 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
QGYsz_wNahGAdqQ43Rh_fKDp.woff2
fonts.gstatic.com/s/worksans/v19/
49 KB
50 KB
Font
General
Full URL
https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 18 Jun 2024 14:52:28 GMT
x-content-type-options
nosniff
age
472833
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50668
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 01:13:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 18 Jun 2025 14:52:28 GMT
Dev-Gradient-Bottom-Top-Purple-Lines.png
www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/png/
120 KB
120 KB
Image
General
Full URL
https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/png/Dev-Gradient-Bottom-Top-Purple-Lines.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-6292885bf0f081c03abe0eedd6656911---666a154b35074.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
55a87f3988c2d2dc254d7fcf23779d87635baace698dda2ff0c1472a37a04599
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-6292885bf0f081c03abe0eedd6656911---666a154b35074.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
2005096
cf-polished
origSize=632173, status=webp_bigger
alt-svc
h3=":443"; ma=86400
content-length
122642
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 May 2024 21:18:03 GMT
server
cloudflare
etag
"6634030b-9a56d"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
8989323afecabb8f-FRA
securonix-icons.woff2
www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/
12 KB
13 KB
Font
General
Full URL
https://www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/securonix-icons.woff2?ver=1.2.51
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dca84be2a8ca915e8c51d04e316d25f8a7d49374c6b22a688ceb7eb05e457920
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
2005720
alt-svc
h3=":443"; ma=86400
content-length
12604
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:29 GMT
server
cloudflare
etag
"66334859-313c"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
8989323b8f64bb8f-FRA
fa-fontello.woff2
www.securonix.com/wp-content/themes/punch/assets/fonts/
5 KB
5 KB
Font
General
Full URL
https://www.securonix.com/wp-content/themes/punch/assets/fonts/fa-fontello.woff2?ver=1.2.51
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e67d703e0c13b20be535d048fac3610238856ddda14cfb9cb5aa8c4a77486b1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
2005720
alt-svc
h3=":443"; ma=86400
content-length
4636
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:39 GMT
server
cloudflare
etag
"66334863-121c"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
8989323b8f65bb8f-FRA
sm.25.html
static.addtoany.com/menu/ Frame DC5D
0
0
Document
General
Full URL
https://static.addtoany.com/menu/sm.25.html
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.securonix.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
age
20096
alt-svc
h3=":443"; ma=86400
cache-control
max-age=315360000, immutable
cf-cache-status
HIT
cf-ray
89893240eb2d3a98-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 24 Jun 2024 02:13:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MCVUE8JdS0WxGNoDD08y1mWwKSMdXTUh%2FQvce1hlPe%2FwsdrgQfuF9szBPGddPko4%2Fi%2Bs2gPSn4Ku2nuaKZA72FJb1RggxtIdIIO0MhkgaIhtTqAL%2Fs6Pq4KjcxKqdZ4DMGolX3Us"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
core.BRQnzO8v.js
static.addtoany.com/menu/modules/
70 KB
26 KB
Script
General
Full URL
https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91b9b24f0aa59668e4d0a770ee7a294b9baa361a76a20ade8128cd0482a5d805
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"25da5432b1057724b8210f17e9b9db05"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=33kvpiZYW9NHZfz%2FupE39ZC2B5dz6%2FlJr2cxcYF93D7VKjc2WPqSGbShI%2FS6OC12U00plKTpeX3wb4PllML5ZMSmguXKSrIlDtIURR2vdlf58NnZjIEjMm97CKEaFMymA3z7PSR%2F"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000, immutable
cf-ray
8989323e6a4da01d-FRA
Securonix-logo-alt.webp
www.securonix.com/wp-content/uploads/2024/04/
14 KB
14 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo-alt.webp
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
195ead3f2c695bbc2891e27e0f4fb3d31f08097370ed4fc66abfe75b07fc238b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
2005450
alt-svc
h3=":443"; ma=86400
content-length
14378
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:30 GMT
server
cloudflare
etag
"6633485a-382a"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
898932413b75bb8f-FRA
phantom_advisory_1C.jpg
www.securonix.com/wp-content/uploads/2024/06/
598 KB
598 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/06/phantom_advisory_1C.jpg
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
982b3c90a89aab3b802883dfc395b2b3e822a819e9a485e915fd416e3a91dd84
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
44621
cf-polished
origSize=650675
alt-svc
h3=":443"; ma=86400
content-length
612326
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100,h2pri
last-modified
Fri, 21 Jun 2024 06:35:06 GMT
server
cloudflare
etag
"66751f1a-9edb3"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
898932413b7abb8f-FRA
base.js
embed.formhq.net/v1/
6 KB
3 KB
Script
General
Full URL
https://embed.formhq.net/v1/base.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4621
cf-polished
origSize=6385
x-xss-protection
1; mode=block
cf-bgj
minify
last-modified
Tue, 01 Nov 2022 14:37:50 GMT
server
cloudflare
etag
W/"63612f3e-18f1"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=miiB6C56NaCQaju3oOqGPJ98IJA91TCwhD1lmIqGUHQEnMtvobb6%2BGj%2FRn7ImgCO9xsFfuFXUf57UunmBkTuGfbymLS54q9Rs5b8z6Iqsx%2F3HUUk6IYLKUt2vvagijfcpsvtagq4tB4fK67X5BEp"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=1800
cf-ray
898932473e4e2bbe-FRA
js
www.googletagmanager.com/gtag/
282 KB
97 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0d3cb048ee7ab5ad50218d7dfdd54f30b95a89784d79c9fae6456c2bf6bd5365
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
99546
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 24 Jun 2024 02:13:03 GMT
6si.min.js
j.6sc.co/
66 KB
18 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
4d3dab569c7b9e24ba3484873769a6b4a34bd3ab4ef6ff53b1c5a5c60f7d5663
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 14 Jun 2024 00:42:44 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"666b9204-10980"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
18315
expires
Mon, 24 Jun 2024 02:13:03 GMT
attributor.min.js
cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/
7 KB
3 KB
Script
General
Full URL
https://cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/attributor.min.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 24 Jun 2024 02:13:03 GMT
x-content-type-options
nosniff
content-encoding
br
age
26206
x-jsd-version
master
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
2823
x-served-by
cache-fra-etou8220054-FRA
x-jsd-version-type
branch
etag
W/"1da1-KfePJ46ikK9jPpNwOZncE3ivfdg"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
destination
www.googletagmanager.com/gtag/
264 KB
91 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-1004449086&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
45ad42ab6b7a443e4163d4e60d2daa1fab25bc33468527b745f1d0ebbfea909a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
93556
x-xss-protection
0
last-modified
Mon, 24 Jun 2024 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 24 Jun 2024 02:13:03 GMT
bat.js
bat.bing.com/
45 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Mon, 24 Jun 2024 02:13:02 GMT
last-modified
Thu, 29 Feb 2024 19:58:06 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 786B5095EFCC4B9A9E18452ECF4F4D39 Ref B: FRA31EDGE0810 Ref C: 2024-06-24T02:13:03Z
etag
"01b4e9c496bda1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13261
insight.min.js
snap.licdn.com/li.lms-analytics/
38 KB
14 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::1720:ee10 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
942a9ba1fe78b402e8b52b83058dbbabde8db6b4d1debf960d6d5afe5192db52
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 18 Jun 2024 16:46:52 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=22911
accept-ranges
bytes
content-length
14004
roundtrip.js
s.adroll.com/j/
88 KB
27 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:5400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cd374bea8f2cce1e9514e9f9a7af6cd7efbb566a5eea5cda53affc1391ada818

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Amz-Version-Id
mo7_u_yH02gprJDRXoC6WhXOKdSomtp.
Content-Encoding
gzip
Via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
Date
Mon, 24 Jun 2024 01:54:53 GMT
Age
1091
X-Amz-Cf-Pop
FRA60-P6
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 05 Jun 2024 15:35:46 GMT
Server
AmazonS3
Etag
W/"39817cce3f515077c86e9cc99a65f623"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Max-Age
600
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
F_nExCfquk-O-T2fwUQG1k2VlDAYRcNuH7CQ-RH4tw8n9BBc27fvxw==
web-vitals.iife.js
unpkg.com/web-vitals@4.2.0/dist/
Redirect Chain
  • https://unpkg.com/web-vitals/dist/web-vitals.iife.js
  • https://unpkg.com/web-vitals@4.2.0/dist/web-vitals.iife.js
7 KB
3 KB
Script
General
Full URL
https://unpkg.com/web-vitals@4.2.0/dist/web-vitals.iife.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Server
2606:4700::6811:f8cb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adf7f9b0dd938575c72ff1592ea18e7ab9bc53ff8838a38c8484c10f5d9be7fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.securonix.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
br
via
1.1 fly.io
cf-cache-status
HIT
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
278286
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01J0VPWPFVHWB7BBNBJGQCB02M-fra
server
cloudflare
etag
"1c0c-hOpjVE2mSiNVJWsLrpc64ergTOY"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
89893247dbf11968-FRA

Redirect headers

date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
br
via
1.1 fly.io
cf-cache-status
HIT
fly-request-id
01J13ZV2WGM135X1RTK8X6FQ09-fra
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
466
server
cloudflare
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/web-vitals@4.2.0/dist/web-vitals.iife.js
cache-control
public, s-maxage=600, max-age=60
cf-ray
898932477b9a1968-FRA
r32rm8p2zmht.js
js.driftt.com/include/1719195300000/
221 KB
62 KB
Script
General
Full URL
https://js.driftt.com/include/1719195300000/r32rm8p2zmht.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-77.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
2037c0cffae2688b5332df106c910e1532df3643c28b9023ff746645acda3f70
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
x-amz-version-id
USw4R1QyON_u1NhEdBvG7FTDCSL9gnOr
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P6
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
x-envoy-upstream-service-time
35
last-modified
Fri, 21 Jun 2024 15:56:20 GMT
server
istio-envoy
etag
W/"e8d94d8bce9981cde582b060ea1cdc6e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
gbooVy-Oqwza26tl3NpIZqThiF9lMj-DoENXfkoXNEkIY9DsBHvIPw==
body.css
www.securonix.com/wp-content/themes/punch/assets/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/themes/punch/assets/css/body.css?v=1.0.94
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
585855ece0f56ae59cf584f5068fc0b2f0742d9e55d6b1ef79b6e54916afbe5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005721
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 02 May 2024 08:01:39 GMT
server
cloudflare
etag
W/"66334863-160c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
898932460f2cbb8f-FRA
body.css
www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/
31 KB
7 KB
Stylesheet
General
Full URL
https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.51
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a63ff7480429d33426dc89e9233838e2e54b46f59d5bac184d907d32def48f97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
2005721
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 28 May 2024 21:15:23 GMT
server
cloudflare
etag
W/"6656496b-7c18"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
898932466f6cbb8f-FRA
de.js
static.addtoany.com/menu/locale/
750 B
1017 B
Script
General
Full URL
https://static.addtoany.com/menu/locale/de.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22086
cf-polished
origSize=902
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"86610d84a116a5704d658324728b063f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cGWyoJcYiwh4nkd14jSp3c1lEQA2Xx68kgN2X7sktVG1ruQFCFHZU25bN%2BfFaPfLaMNiiKT2gPjgQEmsicLhviJwFYb5aUf2uCufjHGGmF9DbcjHvIHgr%2FvxURg0wLrBhwJlbhRHMIPRsLm9uL91EPX%2B"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400, stale-while-revalidate=30, public
cf-ray
89893246b82bbb35-FRA
linkedin.js
static.addtoany.com/menu/svg/icons/
435 B
821 B
Script
General
Full URL
https://static.addtoany.com/menu/svg/icons/linkedin.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"00b1b78053ab07c79bfea2e5a1db9d70"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sCk1fbs0YbQmyhtnSMJXMmH9Y0V4AxMG60FcQIgKWvgeumSlcnIhaJp4K2eWrg6FwUXuQfp1kQoMVGtKbb66H46vS9D38mi8%2B%2BYZQgBbqKDQRrynPclRGEUZgms3p7KhSGZ8t80L"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=7776000, stale-while-revalidate=30, public
cf-ray
89893246cfeea01d-FRA
twitter.js
static.addtoany.com/menu/svg/icons/
645 B
909 B
Script
General
Full URL
https://static.addtoany.com/menu/svg/icons/twitter.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3003867b66a32c12fdafeefc27cf06d906e5a99ba275550ab757f4bb04834636
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"af2b829f9b79fabec7c0148a8b7e444b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8N23wcjHcWKv%2BBTldWLxv6vMLDlXhv3uYZxaKqnE1kFpf68eEDrwJQ2Z32HTNDb7cwtYpcUrxgAqciL%2BwJ3XSM0Yi%2BFtLudMJ3R4%2FyZHJNVa%2BobFX1lUAfvGzIk60pW8wCwzNIll"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=7776000, stale-while-revalidate=30, public
cf-ray
89893246cff0a01d-FRA
facebook.js
static.addtoany.com/menu/svg/icons/
429 B
810 B
Script
General
Full URL
https://static.addtoany.com/menu/svg/icons/facebook.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b475960843a5619b907af1f0a89e3136bd5e6a4a700ec78cb417f302647cf49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"68925fa8e347041c6006837e73c518bc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ggadXD1X3IlQ8%2FSj2RzuqPNNok8FM%2BnSG9eBDo1oLuGmwttfJEggdMUWTFDyEdhUhjfd3kxqXmOK91lK3%2BAKpLY6vl9lqwi0i2Fqt4fblxpCerkyLjuU21AYo6E7MXiTsGaUnhJG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=7776000, stale-while-revalidate=30, public
cf-ray
89893246cff1a01d-FRA
a2a.js
static.addtoany.com/menu/svg/icons/
182 B
664 B
Script
General
Full URL
https://static.addtoany.com/menu/svg/icons/a2a.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"0aca4ea1e5f8f250126a8e0c597dd969"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CXZHd4P9M99j%2FePgokrYLof0AlmM1ky2sYLFjleBNaMGAuR29AGuI9rhiBTz13Po5CS%2BcS77%2Bjfzm4qdRAIOlb5b9YyHyGZgKsqwJd%2FbJ394PRKHxczzZoJNwoJC5jxLAdW720bG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=7776000, stale-while-revalidate=30, public
cf-ray
89893246dff7a01d-FRA
email.js
static.addtoany.com/menu/svg/icons/
415 B
818 B
Script
General
Full URL
https://static.addtoany.com/menu/svg/icons/email.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin
https://www.securonix.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"eb2119ad4221a9d01abc336e06962867"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IZ%2ByjoOWsf64T8apdMJJqyzPkeQjSrk9lt4%2FXnoFYjo2CXX2oovhY6bBi%2Fn4hsHXEF7j9bjNa8okG%2FPMHBVgC91C%2BR36UaiVMzMcpcS2Bn07m1XJdtpi8PPax5LLZRfrzVtWoACK"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=7776000, stale-while-revalidate=30, public
cf-ray
89893246dff8a01d-FRA
wp-emoji-release.min.js
www.securonix.com/wp-includes/js/
18 KB
5 KB
Script
General
Full URL
https://www.securonix.com/wp-includes/js/wp-emoji-release.min.js?ver=6.5.3
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
878230
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 13 Feb 2024 14:36:07 GMT
server
cloudflare
etag
W/"65cb7e57-4926"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
cf-ray
89893246dfd0bb8f-FRA
bWFya2V0bw.js
embed.formhq.net/v1/platforms/
422 B
574 B
Script
General
Full URL
https://embed.formhq.net/v1/platforms/bWFya2V0bw.js
Requested by
Host: embed.formhq.net
URL: https://embed.formhq.net/v1/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5456
cf-polished
origSize=423
x-xss-protection
1; mode=block
cf-bgj
minify
last-modified
Tue, 02 Aug 2022 14:00:38 GMT
server
cloudflare
etag
W/"62e92e06-1a7"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=06SNfPP1L6cRqD3mY392WWhswbphWpkj7f9eIXUrm6awRvXiSpstYoiBUFFrjJUAvL08msT9ZERuPEZtkxJ%2FOT8%2Bs%2Fduz7A5S4Gb6BoQqXyjdg2jBWT5ekQVGa7Rfex7vZ3Osme0NvJ4MC0UJjBO"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=1800
cf-ray
89893247be8d2bbe-FRA
collect
region1.analytics.google.com/g/
0
256 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je46j0v891181397za200&_p=1719195183.376&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&tag_exp=0&cid=1526185050.1719195183&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.114%7CGoogle%2520Chrome%3B126.0.6478.114&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&sid=1719195183&sct=1&seg=0&dt=Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=3808&_z=sendBeacon
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:04 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.securonix.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
256 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JPYDLXGD3Q&cid=1526185050.1719195183&gtm=45je46j0v891181397za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:04 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.securonix.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JPYDLXGD3Q&cid=1526185050.1719195183&gtm=45je46j0v891181397za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=2126054284
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:04 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
px.ads.linkedin.com/wa/
0
701 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Accept
*
Referer
https://www.securonix.com/
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:03 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 7C2D116BBE244B879308F6646299B3DA Ref B: FRAEDGE1206 Ref C: 2024-06-24T02:13:04Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
access-control-allow-origin
https://www.securonix.com
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYbmVJGJQnYSaL2ONBUgw==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
756 B
Script
General
Full URL
https://s.adroll.com/j/pre/index.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
HTTP/1.1
Server
2600:9000:2644:5400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.securonix.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Date
Sun, 23 Jun 2024 06:14:11 GMT
Via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
Age
71934
X-Amz-Cf-Pop
FRA60-P6
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
600
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
9ueiChvVGhcnVjqmiGLjfB-2bEjvfSarezaKEc2oe_zm7thN02D1yw==

Redirect headers

Date
Sun, 23 Jun 2024 19:11:25 GMT
Via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
Age
25298
X-Amz-Cf-Pop
FRA60-P6
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
mj1xUTmTT1erzmm3C7rT11e7CKXfOGLIkeou3wjnN497Ts1DJ8-dHw==
index.js
s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/
9 KB
4 KB
Script
General
Full URL
https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:5400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Amz-Version-Id
zW02zsONcbZViNDkML28W_W3D7qneuQD
Content-Encoding
gzip
Via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
Date
Mon, 24 Jun 2024 02:05:59 GMT
Age
426
X-Amz-Cf-Pop
FRA60-P6
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Fri, 14 Jun 2024 12:31:47 GMT
Server
AmazonS3
Etag
W/"706be4fd28aeb971d2ff83a528c2073a"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Max-Age
600
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
y3_xfUE1TiEO_q3wzn-PncQeXqeJTRxQoMNHT_zBFUqJ6qbKBJ2ESQ==
attribution_trigger
px.ads.linkedin.com/
2 B
1 KB
XHR
General
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=61924&time=1719195184737&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&tm=gtmv2
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
*
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

attribution-reporting-register-trigger
{"event_trigger_data":[{"trigger_data":"1","priority":"0"}],"filters":[{"c":["177720376"]},{"c":["164948506"]},{"c":["127114126"]},{"c":["177720376"]},{"c":["175293946"]}],"debug_key":"142169"}
content-encoding
gzip
date
Mon, 24 Jun 2024 02:13:04 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: D824DEF01004439C9C268413209F3048 Ref B: FRAEDGE1406 Ref C: 2024-06-24T02:13:04Z
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
x-li-proto
http/2
x-restli-protocol-version
1.0.0
access-control-allow-headers
*
x-li-uuid
AAYbmVJLB91TZzJl6Z0mqw==
x-fs-uuid
00061b99524b07dd53673265e99d26ab
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1719195184737&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1719195184737&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-cshar...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1719195184737&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&tm=gtmv2&e_ipv6=AQLa-jUpHiT7fAAAAZBIBK67ah8cX4m3zUTFgPTukJ4g04go_aCQu8GMBI2KaJPQ9gg2foDFriVn
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.securonix.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 24 Jun 2024 02:13:04 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: DF88418F27034B08B24B9928D368E3C9 Ref B: FRAEDGE1810 Ref C: 2024-06-24T02:13:05Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYbmVJSuoMtGPxGQ+Z43w==

Redirect headers

date
Mon, 24 Jun 2024 02:13:04 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 9BBD8EDCC04647EEB61F13A69E36D42E Ref B: FRAEDGE1206 Ref C: 2024-06-24T02:13:04Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1719195184737&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&tm=gtmv2&e_ipv6=AQLa-jUpHiT7fAAAAZBIBK67ah8cX4m3zUTFgPTukJ4g04go_aCQu8GMBI2KaJPQ9gg2foDFriVn
x-li-proto
http/2
content-length
0
x-li-uuid
AAYbmVJKbM2xC/mcO7BN3A==
VJKZ2AZ6BRDQFPNHOW6CAP
d.adroll.com/consent/check/
493 B
586 B
Script
General
Full URL
https://d.adroll.com/consent/check/VJKZ2AZ6BRDQFPNHOW6CAP?pv=63598535807.84756&arrfrr=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&_s=12a7f44411030e3a11e1c7e114f55f03&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe04:fb70:ccb8:d518:83e8 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
afb7ce1ad923271df619ce809b338d1e9f995385eaf6a43565ca237d8dc1523d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:05 GMT
server
nginx/1.22.1
content-length
493
content-type
application/javascript
27010718.js
bat.bing.com/p/action/
0
118 B
Script
General
Full URL
https://bat.bing.com/p/action/27010718.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Mon, 24 Jun 2024 02:13:04 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 69B912B2452F4BF7A5EA6FBBE38C8657 Ref B: FRA31EDGE0810 Ref C: 2024-06-24T02:13:04Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/
0
286 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=27010718&tm=gtm002&Ver=2&mid=9d140c90-9098-46b1-9f4c-1681f4a1edc2&sid=4a6163f031cf11efa1bc8f98932c7be0&vid=4a62c60031cf11ef8a9e75db2bf88e90&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix&p=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&r=&lt=3575&evt=pageLoad&sv=1&rn=847183
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 24 Jun 2024 02:13:04 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: D38718D8457843128E6FA999A0C06DC5 Ref B: FRA31EDGE0810 Ref C: 2024-06-24T02:13:04Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
c.6sc.co/
7 B
195 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:04 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.securonix.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
23 B
318 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f7dee2a88356549b15d6145e3170e69825aa94d38e4809fc690142eb69481484

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:05 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.securonix.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1719195184850_388391900_514686189_22_852_24_422_219";dur=1
content-length
23
expires
Mon, 24 Jun 2024 02:13:05 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A04%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:04 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:04 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2024%20Jun%202024%2002%3A13%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205b12115ad17914938bf7667643ca0d3%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2024%20Jun%202024%2002%3A13%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2024%20Jun%202024%2002%3A13%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2024%20Jun%202024%2002%3A13%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2245bc92abc111f3fccbf9c8779059ecfc1d69c9e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2024%20Jun%202024%2002%3A13%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:04 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:04 GMT
details
epsilon.6sense.com/v3/company/
769 B
729 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software
nginx /
Resource Hash
95811f2672a1cf262a5e150923ea639727bcf58455017a53c98e9824ced92675

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
Authorization
Token 45bc92abc111f3fccbf9c8779059ecfc1d69c9e6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
X-6s-CustomID
WebTag1.0 05b12115ad17914938bf7667643ca0d3
Referer
https://www.securonix.com/
sec-ch-ua-platform
"Win32"

Response headers

x-trace-id
3638443687164191051
date
Mon, 24 Jun 2024 02:13:05 GMT
content-encoding
gzip
server
nginx
vary
Origin, Accept-Encoding
content-type
application/json
x-6si-region
eu-central-1a
access-control-allow-origin
https://www.securonix.com
access-control-expose-headers
X-6si-Region
access-control-allow-credentials
true
timing-allow-origin
https://6sense.com, https://www.ssga.com
content-length
407
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.securonix.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.securonix.com
access-control-expose-headers
X-6si-Region
access-control-max-age
1800
date
Mon, 24 Jun 2024 02:13:05 GMT
server
nginx
timing-allow-origin
https://6sense.com, https://www.ssga.com
x-6si-region
eu-central-1a
x-trace-id
4310630681313651148
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A8%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:05 GMT
x-content-type-options
nosniff
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:05 GMT
consent_tcfv2.js
s.adroll.com/j/
413 KB
83 KB
Script
General
Full URL
https://s.adroll.com/j/consent_tcfv2.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:5400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
07b09b318c1d52ee134b788ec7834744cb9e6fd4bc19663988534fc29c3e7b1c

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Amz-Version-Id
OGpIu_84T3drKaDERUwfgDZMK.anucOX
Content-Encoding
gzip
Via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
Date
Mon, 24 Jun 2024 02:09:22 GMT
Age
224
X-Amz-Cf-Pop
FRA60-P6
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 29 May 2024 19:02:37 GMT
Server
AmazonS3
Etag
W/"5c3eafaf4760f345e170d1d226c98d22"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Max-Age
600
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
DF9TCaUKs-vvArpcoWyhRdT8QmoOIidoTR88mXfQDOr6PkALo03zqQ==
nextroll-32x32.png
s.adroll.com/i/favicon/
2 KB
2 KB
Image
General
Full URL
https://s.adroll.com/i/favicon/nextroll-32x32.png
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:5400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sun, 23 Jun 2024 06:15:35 GMT
X-Amz-Version-Id
eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Via
1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
Age
71850
X-Amz-Cf-Pop
FRA60-P6
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1615
Last-Modified
Mon, 28 Jun 2021 18:19:21 GMT
Server
AmazonS3
Etag
"403a0a7dcf2d617e7ea852bfb9d11945"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
OR1KTH_IV3CHHT8qCTmbyLHuCjFTz_LS9PGvcHdmzym87wYhV5n4mA==
core
js.driftt.com/ Frame 6EF4
0
0
Document
General
Full URL
https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=83f1ee13-53d3-4817-a0bd-75a36c5d06f4&sessionStarted=1719195185.453&campaignRefreshToken=ba4519a7-f38d-4488-a3f4-8d79ef6e568f&hideController=false&pageLoadStartTime=1719195180052&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1719195300000/r32rm8p2zmht.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-73.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.securonix.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 24 Jun 2024 02:13:05 GMT
etag
W/"74a81592f0631c08ef97fa9ab4eb35c0"
last-modified
Fri, 21 Jun 2024 15:56:07 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 e221f111ed3ebc025b531e81056d37a4.cloudfront.net (CloudFront)
x-amz-cf-id
I5B5gbWBiJckcPYnvM6jnDT8VT2DpZRSOhEPxRc8pJsUY-npnBlPwQ==
x-amz-cf-pop
FRA60-P6
x-amz-server-side-encryption
AES256
x-amz-version-id
SJ6foYnSjzz7jwTNyrUHCGj6UyWE9zz7
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
21
chat
js.driftt.com/core/ Frame 9B5C
0
0
Document
General
Full URL
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1719195180052
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1719195300000/r32rm8p2zmht.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-73.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.securonix.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 24 Jun 2024 02:13:05 GMT
etag
W/"74a81592f0631c08ef97fa9ab4eb35c0"
last-modified
Fri, 21 Jun 2024 15:56:07 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 e221f111ed3ebc025b531e81056d37a4.cloudfront.net (CloudFront)
x-amz-cf-id
dDoTD7by7-t9OKkKqPlLMi6FxnopBJYoRdWRsppssoQcKG-C5BAazw==
x-amz-cf-pop
FRA60-P6
x-amz-server-side-encryption
AES256
x-amz-version-id
SJ6foYnSjzz7jwTNyrUHCGj6UyWE9zz7
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
22
zi-tag.js
js.zi-scripts.com/
9 KB
3 KB
Script
General
Full URL
https://js.zi-scripts.com/zi-tag.js
Requested by
Host: www.securonix.com
URL: https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a970fcb88957b38e49bb4ae19bdac7e5a338e802424d6762ccf00547bac00f0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:05 GMT
x-amz-version-id
.IABYDhQRwfK4422i8AaO7SJe8oWFOPg
via
1.1 9987fa8ab620895e83d1d8f10c40f6d2.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
content-encoding
gzip
x-amz-cf-pop
FRA56-P4
age
66302
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 18 Jun 2024 07:47:56 GMT
server
cloudflare
etag
W/"0f07d07f5eb912f08d3e8229b4e8f938"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
89893255bb2518dc-FRA
x-amz-cf-id
p3W4s1RjQYAhRYOGPdsFkAOPqW1txSWWxPKdmTUJmq7k0sbOTVzIqA==
getSubscriptions
js.zi-scripts.com/unified/v1/master/
203 B
562 B
Fetch
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
8fefc85466f11496606bb39fe119bdbe374fe61c6f7e66e8a0f58e99c3617947

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
Authorization
Bearer 3e8e82dad11669757953
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.securonix.com/
visited_url
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/

Response headers

date
Mon, 24 Jun 2024 02:13:06 GMT
via
1.1 9987fa8ab620895e83d1d8f10c40f6d2.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
x-amz-cf-pop
FRA56-P4
x-powered-by
Express
x-cache
Miss from cloudfront
alt-svc
h3=":443"; ma=86400
apigw-requestid
Z2Zn4iVWPHcESKg=
server
cloudflare
etag
W/"cb-VPMEQfDSTJ3O1JXhR2v1Gn+ILLE"
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cf-ray
898932575f6090da-FRA
x-amz-cf-id
NTD1KUm3E4sVjHHs4l3GIQsmMiRVLhMZdSL-HgA6ByGUwfTQv826Sw==
getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame
0
0
Preflight
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type,visited_url
Access-Control-Request-Method
GET
Origin
https://www.securonix.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
access-control-max-age
0
alt-svc
h3=":443"; ma=86400
apigw-requestid
Z2Zn0h3YPHcESJg=
cf-cache-status
DYNAMIC
cf-ray
898932562ee690da-FRA
date
Mon, 24 Jun 2024 02:13:05 GMT
server
cloudflare
vary
Access-Control-Request-Headers
via
1.1 9987fa8ab620895e83d1d8f10c40f6d2.cloudfront.net (CloudFront)
x-amz-cf-id
90sFs40vUE2-JPm7nxQopUt7-FAj6KWJlSq4fU9dewnh5f8N-MjbdA==
x-amz-cf-pop
FRA56-P4
x-cache
Miss from cloudfront
x-powered-by
Express
Securonix-EON-Data-Sheet-Featured-Image.jpg
www.securonix.com/wp-content/uploads/2024/04/
72 KB
72 KB
Image
General
Full URL
https://www.securonix.com/wp-content/uploads/2024/04/Securonix-EON-Data-Sheet-Featured-Image.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
515af980f6f9699ff77fa791ebab1eb62c21a31e37ed0acb10fc5da61e131824
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
86687
cf-polished
origSize=73758
alt-svc
h3=":443"; ma=86400
content-length
73750
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 May 2024 16:59:00 GMT
server
cloudflare
etag
"6633c654-1201e"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
898932561d9abb8f-FRA
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A04%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:05 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:05 GMT
cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png
www.securonix.com/wp-content/uploads/2021/12/
676 B
1 KB
Other
General
Full URL
https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d381f3799814c3df53d341b475363a0c9116fb644fdd96b953d93950a6c1155b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
2005453
cf-polished
origFmt=png, origSize=836
content-disposition
inline; filename="cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.webp"
alt-svc
h3=":443"; ma=86400
content-length
676
referrer-policy
strict-origin-when-cross-origin
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 May 2024 08:01:35 GMT
server
cloudflare
etag
"6633485f-344"
vary
Accept
x-frame-options
SAMEORIGIN
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
permissions-policy
geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges
bytes
cf-ray
89893259a8b0bb8f-FRA
/
ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
_vtok,_zitok,content-type,visited-url
Access-Control-Request-Method
GET
Origin
https://www.securonix.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin
https://www.securonix.com
allow
GET,HEAD
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8989325a89f792a5-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 24 Jun 2024 02:13:06 GMT
server
cloudflare
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
formcomplete.js
ws-assets.zoominfo.com/
90 KB
27 KB
Script
General
Full URL
https://ws-assets.zoominfo.com/formcomplete.js
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:06 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
age
1583
x-guploader-uploadid
ACJd0NrSOlYZ6d9Ide1vN2YFfhkAiErMEH7w-Lxf9eDWWf8_ZIlGdZYK4n04lzDykFwfAs5pByQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 16 May 2024 10:14:37 GMT
server
cloudflare
etag
W/"006455bd44ed289ddcc403d0ecd96ab0"
x-goog-hash
crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA==
x-goog-generation
1715854477710382
content-type
application/javascript
cache-control
public, max-age=3600
x-goog-stored-content-length
91778
cf-ray
8989325aac203675-FRA
expires
Mon, 24 Jun 2024 02:46:43 GMT
/
ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/
3 KB
2 KB
Fetch
General
Full URL
https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
dea3df8d556b7fc80d11df6b74a8baee0a5d33e8eb2289b04393bb8aedbe4543
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/javascript
visited-url
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
Referer
https://www.securonix.com/blog/analysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan/
_vtok
MjE3LjExNC4yMTguMjY=
_zitok
850b45a65481715112101719195186
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
https://www.securonix.com
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc
h3=":443"; ma=86400
cf-ray
8989325bcb3d1d9c-FRA
forms
ws.zoominfo.com/formcomplete-v2/
320 B
616 B
Fetch
General
Full URL
https://ws.zoominfo.com/formcomplete-v2/forms
Requested by
Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
def1ad6278532b1e7ae1b77b4964f48a12b5acc33872eab663855483997b718e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
Authorization
bearer f0ddbd6ba8265551bbe95c25bdf2a9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.securonix.com/
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 02:13:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
x-powered-by
Express
alt-svc
h3=":443"; ma=86400
server
cloudflare
etag
W/"140-/3+OW/4aU4/AnqAmyrwCzrd9buM"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.securonix.com
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
cf-ray
8989325c7bb51d9c-FRA
forms
ws.zoominfo.com/formcomplete-v2/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/formcomplete-v2/forms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://www.securonix.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin
https://www.securonix.com
allow
POST
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8989325b5a3c92a5-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 24 Jun 2024 02:13:06 GMT
server
cloudflare
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
5e7ef9ed-f809-4b72-a932-02aa71ba16e3
https://www.securonix.com/
3 KB
0
Script
General
Full URL
blob:https://www.securonix.com/5e7ef9ed-f809-4b72-a932-02aa71ba16e3
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dea3df8d556b7fc80d11df6b74a8baee0a5d33e8eb2289b04393bb8aedbe4543

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
2932
Content-Type
text/javascript
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A05%20GMT%22%2C%22timeSpent%22%3A%221016%22%2C%22totalTimeSpent%22%3A%222020%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:06 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:06 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A06%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223021%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:07 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:07 GMT
3.ee35dea2.chunk.js
js.driftt.com/conductor/assets/
158 B
853 B
Script
General
Full URL
https://js.driftt.com/conductor/assets/3.ee35dea2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1719195300000/r32rm8p2zmht.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-77.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 23 Jul 2023 23:38:44 GMT
x-amz-version-id
pMohofQYEF1dohPHFcPmV3oeRzVr6CuK
via
1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA60-P6
age
29039664
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
22
content-length
158
last-modified
Fri, 21 Jul 2023 20:53:14 GMT
server
istio-envoy
etag
"e6714addd36102488fb27a980401fd36"
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Ui9Q7yltzX6cKSFUQT3f-WGbkrH0QeyIiYgsCsKHcPHw0SCjpPmTtA==
notification.5f7c6014.mp3
js.driftt.com/conductor/assets/media/
8 KB
8 KB
Media
General
Full URL
https://js.driftt.com/conductor/assets/media/notification.5f7c6014.mp3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.86.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-86-77.fra60.r.cloudfront.net
Software
istio-envoy /
Resource Hash
bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Encoding
identity;q=1, *;q=0
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Referer
https://www.securonix.com/
Range
bytes=0-
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 20 Sep 2023 11:20:11 GMT
x-amz-version-id
AJ3ftWhvW2h954Q3Lc0BJKBcX87AS953
via
1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA60-P6
age
23986377
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
Content-Range
bytes 0-7754/7755
x-envoy-upstream-service-time
16
Content-Length
7755
last-modified
Mon, 18 Sep 2023 19:58:12 GMT
server
istio-envoy
etag
"5f7c6014cf73831f91963a668b71fbb9"
access-control-allow-methods
GET, POST, OPTIONS
content-type
audio/mpeg
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
UdY9Nkwy78lBxHMjMijEHPg-1dwhgMTSVbpW622zRBp012wWrTec3Q==
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A08%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A07%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224021%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:08 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:08 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=058b1a05-087d-4dc3-8d62-9ed9093092a5&session=160f31d8-3f6a-4c00-8a0c-1746b9b342a9&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A09%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2024%20Jun%202024%2002%3A13%3A08%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225022%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20(STR)%20team%20has%20identified%20the%20use%20of%20a%20stealthy%20backdoor%20payload%20likely%20targeting%20Pakistani%20victims%20via%20unsolicited%20messages.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20PHANTOM%23SPIKE%3A%20Attackers%20Leveraging%20CHM%20Files%20to%20Run%20Custom%20CSharp%20Backdoors%20Likely%20Targeting%20Victims%20Associated%20with%20Pakistan%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-phantomspike-attackers-leveraging-chm-files-to-run-custom-csharp-backdoors-likely-targeting-victims-associated-with-pakistan%2F&pageViewId=835822e3-9d92-462b-8139-647623e43e95&v=1.1.21
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.98.18 Dublin, Ireland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-98-18.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.securonix.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 02:13:09 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Mon, 24 Jun 2024 02:13:09 GMT

Verdicts & Comments Add Verdict or Comment

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 undefined| event object| fence object| sharedStorage string| ajaxurl string| apikey string| gtm4wp_datalayer_name object| dataLayer object| _wpemojiSettings function| $ function| jQuery function| ajax object| a2a_config object| zi string| ZIProjectKey object| dataLayer_content boolean| avia_is_mobile object| punch_globals object| a2a function| a2a_init object| lazySizes object| google_tag_manager object| google_tag_data object| gtranslateSettings function| scriptAppender function| styleAppender object| FormHQ function| improvedGA4 object| improvedGA4dataLayer function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| _linkedin_data_partner_ids boolean| _already_called_lintrk string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded function| drift undefined| driftt function| a2a_show_dropdown function| a2a_miniLeaveDelay number| a2apage_init function| doGTranslate function| googleTranslateElementInit2 object| a2a_localize object| twemoji object| wp function| _typeof object| script object| gaGlobal function| Attributor object| __utmz function| lintrk object| ORIBILI string| adroll_sid object| __adroll_consent_data object| adroll object| __adroll boolean| adroll_optout object| adroll_loaded object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback function| UET function| UET_init function| UET_push object| ueto_8f4f102e7d object| uetq object| webVitals object| 3eiXJRXgVuLsYGH9303q object| regeneratorRuntime object| _driftFrames object| __post_robot_10_0_46__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked function| __cmp function| __tcfapi function| __gpp boolean| _storagePopulated object| adroll_exp_list object| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| $jscomp string| BANNER_VERSION string| TCF_VERSION string| IABWRITE_NO_COOKIE object| __adroll_consent_banner object| __adroll_consent_prev_lastchild object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id object| drift_frameFactory object| drift_audio_context function| onYouTubeIframeAPIReady object| zitag object| ZILogs function| loadZILogs function| errorHandler object| _zi_fc object| _zi object| ziws object| drift_sentry_config string| thisTabID object| drift_notification_waiting

19 Cookies

Domain/Path Name / Value
.securonix.com/ Name: _gcl_au
Value: 1.1.792587182.1719195183
.securonix.com/ Name: _ga
Value: GA1.1.1526185050.1719195183
.securonix.com/ Name: attr_first
Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20set)%22%2C%22content%22%3A%22(not%20set)%22%2C%22source_platform%22%3A%22(not%20set)%22%2C%22marketing_tactic%22%3A%22(not%20set)%22%2C%22creative_format%22%3A%22(not%20set)%22%2C%22adgroup%22%3A%22(not%20set)%22%2C%22id%22%3A%22(not%20set)%22%7D
.securonix.com/ Name: attr_last
Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20set)%22%2C%22content%22%3A%22(not%20set)%22%2C%22source_platform%22%3A%22(not%20set)%22%2C%22marketing_tactic%22%3A%22(not%20set)%22%2C%22creative_format%22%3A%22(not%20set)%22%2C%22adgroup%22%3A%22(not%20set)%22%2C%22id%22%3A%22(not%20set)%22%7D
.linkedin.com/ Name: bcookie
Value: "v=2&9144f677-6ac7-4a91-802d-9c3816dac559"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MTkxOTUxODQ7MjswMjFagJ4GE7rUkqdSeJB4+xgMLepuu0x3kEJDnsUZSwU8NA==
.linkedin.com/ Name: lidc
Value: "b=TGST00:s=T:r=T:a=T:p=T:g=3436:u=1:x=1:i=1719195184:t=1719281584:v=2:sig=AQH7e_D5fcQllHysoaS4zAfW7zDV2Lhe"
.securonix.com/ Name: _uetsid
Value: 4a6163f031cf11efa1bc8f98932c7be0
.securonix.com/ Name: _uetvid
Value: 4a62c60031cf11ef8a9e75db2bf88e90
www.securonix.com/ Name: _gd_visitor
Value: 058b1a05-087d-4dc3-8d62-9ed9093092a5
www.securonix.com/ Name: _gd_session
Value: 160f31d8-3f6a-4c00-8a0c-1746b9b342a9
.bing.com/ Name: MUID
Value: 0DDA19ED051B65C60CAE0D4504B764D1
www.securonix.com/ Name: drift_campaign_refresh
Value: ba4519a7-f38d-4488-a3f4-8d79ef6e568f
.www.securonix.com/ Name: _zitok
Value: 850b45a65481715112101719195186
.zoominfo.com/ Name: __cf_bm
Value: faTInlcXyHyDBvR3YlfboGcFiDody8sTmFHwnCUJt.A-1719195186-1.0.1.1-.pcYIG83rwTJN6PZjyQ3WhKFH7_W79LwPFU_U3gL.w1qConTFkD937FgsfjLrocCgrRTNT5vn2FtJLthCK2EgA
.zoominfo.com/ Name: _cfuvid
Value: nygyAXDtYYD8SigUtpLZcGg_VJ9D3gA1e2j40QXwsfo-1719195186400-0.0.1.1-604800000
www.securonix.com/ Name: drift_aid
Value: 8d9bc9ce-e53f-415c-84bb-ee0f90cda34b
www.securonix.com/ Name: driftt_aid
Value: 8d9bc9ce-e53f-415c-84bb-ee0f90cda34b
.securonix.com/ Name: _ga_JPYDLXGD3Q
Value: GS1.1.1719195183.1.0.1719195187.56.0.0

6 Console Messages

Source Level URL
Text
network error URL: https://www.securonix.com/wp-content/themes/punch/styles/css/style.css?ver=6.5.3
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.securonix.com/wp-content/themes/punch/styles/css/bootstrap.min.css?ver=3.3.2
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.securonix.com/wp-content/themes/punch/js/library.js?ver=6.5.3
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.securonix.com/wp-content/themes/punch/js/bootstrap.min.js?ver=3.3.2
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.securonix.com/wp-content/themes/punch/js/global.js?ver=6.5.3
Message:
Failed to load resource: the server responded with a status of 404 ()
other warning URL: https://js.driftt.com/include/1719195300000/r32rm8p2zmht.js
Message:
The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn.jsdelivr.net
cdnjs.cloudflare.com
d.adroll.com
embed.formhq.net
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.zi-scripts.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.adroll.com
snap.licdn.com
static.addtoany.com
stats.g.doubleclick.net
unpkg.com
ws-assets.zoominfo.com
ws.zoominfo.com
www.google.de
www.googletagmanager.com
www.securonix.com
104.16.117.43
104.16.118.43
104.18.37.212
13.107.42.14
141.193.213.21
142.250.184.227
172.67.39.148
18.245.86.73
18.245.86.77
2001:4860:4802:32::36
2600:9000:2644:5400:6:9280:1080:93a1
2606:4700:3108::ac42:2bc5
2606:4700::6811:180e
2606:4700::6811:f8cb
2620:1ec:21::14
2620:1ec:c11::237
2a00:1450:4001:80e::2008
2a00:1450:4001:811::200a
2a00:1450:4001:81d::2003
2a00:1450:4001:829::200a
2a00:1450:400c:c06::9b
2a02:26f0:480:23::1726:629c
2a02:26f0:7100::1720:ee10
2a04:4e42:600::485
2a05:d018:cc3:fe04:fb70:ccb8:d518:83e8
76.223.9.105
95.100.98.18
0230904fa157dff50d8ecc1a80a203635fa812479f4432a69c3779986ab560e6
07b09b318c1d52ee134b788ec7834744cb9e6fd4bc19663988534fc29c3e7b1c
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
09ba5df6e121c4577cac7addaca7ab9f189e8c1afd745652396b05f8e45baf0a
09bfea7e712355726b2d97bf0a13a80f8f8e5e5834a13d666d1cea2bd3ab31a9
0d3cb048ee7ab5ad50218d7dfdd54f30b95a89784d79c9fae6456c2bf6bd5365
195ead3f2c695bbc2891e27e0f4fb3d31f08097370ed4fc66abfe75b07fc238b
1a970fcb88957b38e49bb4ae19bdac7e5a338e802424d6762ccf00547bac00f0
1c93626ad32b3449b19ebd9c7e5dfa53947c8ed99ede81a422b146ac6da791fc
2037c0cffae2688b5332df106c910e1532df3643c28b9023ff746645acda3f70
27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db
2b0eefb585a8e3a1a8e2b60d258efd22af0847adb3a09c26d66104b151464fb9
2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4
2bf92d09ea70e1745242a22e86adb8088bc17c61a744c2f3d984601f6bd4e423
3003867b66a32c12fdafeefc27cf06d906e5a99ba275550ab757f4bb04834636
3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b
32f274178facd20384d11f4cf5d6cb7aa0d72c1a544da5d66a441d703030b518
3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43
3fcc408630bdf993595abbcc2a7ace8a55058dd7a3107236a68cd76a690e1ae9
435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44fe36f267735fedc846090b255f109da041d2d02c0a6c5d9b218e493e8521ca
45ad42ab6b7a443e4163d4e60d2daa1fab25bc33468527b745f1d0ebbfea909a
4b475960843a5619b907af1f0a89e3136bd5e6a4a700ec78cb417f302647cf49
4ba0dc4a2c348e233bb9d06d948ac25172b3dafbe04aac1692e925742fcf095a
4d3dab569c7b9e24ba3484873769a6b4a34bd3ab4ef6ff53b1c5a5c60f7d5663
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
515af980f6f9699ff77fa791ebab1eb62c21a31e37ed0acb10fc5da61e131824
55a87f3988c2d2dc254d7fcf23779d87635baace698dda2ff0c1472a37a04599
585855ece0f56ae59cf584f5068fc0b2f0742d9e55d6b1ef79b6e54916afbe5e
5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c
5bdcc9e3e427ad3a787ec7efe46d8c305e880eb44402c0000ff52f17ef6b0cdb
5ebb2ce2e9e5c77cc2c4081b2d88c1f10d471b0f9b440e672465d276f507273a
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
6dceecf8eaa03968e40b767206be8a36a13d7444557fced227454ae4f100e5c9
6e0cc78c402cbc02fdfd41cd77c5fd6ffbd8066cc07935ea8eb5f3fcc59744a3
6e67d703e0c13b20be535d048fac3610238856ddda14cfb9cb5aa8c4a77486b1
7bb7cca3d35df9505bb0017fc721ca530db99fd3497e2bc991027e1edc532d84
80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8
814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4
8c10bfd761676feda6e280e0d31794b1a8d21279f437ddb817a708d6fe0b72db
8fefc85466f11496606bb39fe119bdbe374fe61c6f7e66e8a0f58e99c3617947
907f4395f54e25a1da1181672f1a498e98b26f7bfc6dcb6c209a737472451e49
91b9b24f0aa59668e4d0a770ee7a294b9baa361a76a20ade8128cd0482a5d805
942a9ba1fe78b402e8b52b83058dbbabde8db6b4d1debf960d6d5afe5192db52
95811f2672a1cf262a5e150923ea639727bcf58455017a53c98e9824ced92675
982b3c90a89aab3b802883dfc395b2b3e822a819e9a485e915fd416e3a91dd84
9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f
a55a1504046635db1567af44c96b2a820151041a3d384726e32dad566684d899
a63ff7480429d33426dc89e9233838e2e54b46f59d5bac184d907d32def48f97
a8f703bd94ac5b9388b21eb31b10373e456985857de57b6fd5ba93d24816c97f
a9e7815ab9e019401e239b040cd31eb6870c6d2ebf30417f47b8ad18e955a908
adf7f9b0dd938575c72ff1592ea18e7ab9bc53ff8838a38c8484c10f5d9be7fd
afb7ce1ad923271df619ce809b338d1e9f995385eaf6a43565ca237d8dc1523d
b866f204d2a5b0fa88df426bfef64de132a4a2ef9cbb03bd42b46853b5f6747a
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027
c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5
cd374bea8f2cce1e9514e9f9a7af6cd7efbb566a5eea5cda53affc1391ada818
ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727
cedfecc02e225c12e1b25ee4f3927b630dbe1daab8b505146d25681f458b5c73
d381f3799814c3df53d341b475363a0c9116fb644fdd96b953d93950a6c1155b
d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453
d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557
d839cf18d046a45de925e9d3fbfb69a972d3e71da1e19f9584369e354adb74f8
dca84be2a8ca915e8c51d04e316d25f8a7d49374c6b22a688ceb7eb05e457920
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dea3df8d556b7fc80d11df6b74a8baee0a5d33e8eb2289b04393bb8aedbe4543
def1ad6278532b1e7ae1b77b4964f48a12b5acc33872eab663855483997b718e
e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7dee2a88356549b15d6145e3170e69825aa94d38e4809fc690142eb69481484
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a