www.forcepoint.com Open in urlscan Pro
2a04:4e42:400::740  Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 98

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID HTTP 307
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.forcepoint.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=www.forcepoint.com&pId=3186238014174036796

123 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
21 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request shadowroot-ransomware-targeting-turkish-businesses Show response www.forcepoint.com/blog/x-labs/	126 KB 44 KB	127ms 45ms	Document text/html	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 483feab2b57e186b9b87d17c0441d26fd342526af75d64c8985a85734b879eb3 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report Strict-Transport-Security max-age=18410000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 614 cache-control public, max-age=3600 content-encoding gzip content-language en content-length 38017 content-security-policy default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report content-type text/html; charset=utf-8 date Thu, 18 Jul 2024 08:20:33 GMT etag W/"1721290218-0" expires Sun, 19 Nov 1978 05:00:00 GMT from-origin same, https://analyticsssl.forcepoint.com,https://vidyard.com http_x_geo_continent EU http_x_geo_region DE-BY last-modified Thu, 18 Jul 2024 08:10:18 GMT link </sites/all/themes/custom/fp/assets/fonts/hoves-optimized//Hoves_DemiBold.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_DemiBold.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Medium.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Regular.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Italic.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light_Italic.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_ExtraLight.woff>; rel=preload; as=font; crossorigin; type="font/woff"; nopush,</misc/throbber-inactive.png>; rel=preload; as=image; type="image/png"; nopush,</misc/throbber-active.gif>; rel=preload; as=image; type="image/gif"; nopush,</misc/grippie.png>; rel=preload; as=image; type="image/png"; nopush,</misc/draggable.png>; rel=preload; as=image; type="image/png"; nopush,</misc/tree.png>; rel=preload; as=image; type="image/png"; nopush,</misc/tree-bottom.png>; rel=preload; as=image; type="image/png"; nopush,</misc/message-24-ok.png>; rel=preload; as=image; type="image/png"; nopush,</misc/message-24-warning.png>; rel=preload; as=image; type="image/png"; nopush,</misc/message-24-error.png>; rel=preload; as=image; type="image/png"; nopush,</misc/help.png>; rel=preload; as=image; type="image/png"; nopush,</misc/menu-expanded.png>; rel=preload; as=image; type="image/png"; nopush,</misc/menu-collapsed.png>; rel=preload; as=image; type="image/png"; nopush,</misc/progress.gif>; rel=preload; as=image; type="image/gif"; nopush,</sites/all/libraries/chosen/chosen-sprite.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/libraries/chosen/chosen-sprite@2x.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_flat_75_ffffff_40x100.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_highlight-soft_75_cccccc_1x100.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_e6e6e6_1x400.png>; rel=preload; as=image; type="image/png"; nopush,</sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_dadada_1x400.png>; rel=preload; as=image; type="image/png"; nopush referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=18410000; includeSubDomains; preload vary Accept-Encoding, x-geo-country, Cookie, Cookie via 1.1 varnish, 1.1 varnish, 1.1 varnish x-cache HIT, HIT, MISS x-cache-hits 1, 9, 0 x-content-type-options nosniff x-drupal-cache MISS x-frame-options SAMEORIGIN x-generator Drupal 7 (http://drupal.org) x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-gk745 x-served-by cache-chi-kigq8000156-CHI, cache-cph2320027-CPH, cache-cph2320055-CPH x-styx-req-id 2ba30fa4-44dd-11ef-baca-4e257a6666f1 x-timer S1721290833.357588,VS0,VE4 x-ua-compatible IE=Edge,chrome=1 x-xss-protection 1
GET H2	200	Hoves_DemiBold.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized//	18 KB 19 KB	57ms 43ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized//Hoves_DemiBold.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-zjqjf content-length 18868 x-served-by cache-chi-kigq8000062-CHI, cache-cph2320032-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:36:00 GMT server nginx x-timer S1721290833.431790,VS0,VE3 etag "66958830-49b4" content-type font/woff access-control-allow-origin * x-styx-req-id 16ff3869-4345-11ef-a32f-9265e67163a1 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 19, 9, 0
GET H2	200	Hoves_DemiBold.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	18 KB 19 KB	105ms 92ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_DemiBold.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-zjqjf content-length 18868 x-served-by cache-chi-kigq8000080-CHI, cache-cph2320026-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290833.432866,VS0,VE3 etag "6695882f-49b4" content-type font/woff access-control-allow-origin * x-styx-req-id 16ff3adc-4345-11ef-a32f-9265e67163a1 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H2	200	Hoves_Medium.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	18 KB 19 KB	60ms 47ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Medium.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c1524c7035a894f370d34f2d57704873a3978adef91d97978e3598515762eace Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-778cbf697c-nf2vw content-length 18688 x-served-by cache-chi-klot8100097-CHI, cache-cph2320045-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290833.432280,VS0,VE3 etag "6695882f-4900" content-type font/woff access-control-allow-origin * x-styx-req-id 16fead65-4345-11ef-b54a-f60fc8a2deb7 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H2	200	Hoves_Regular.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	18 KB 18 KB	66ms 54ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Regular.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 42793f24dc3fddca04cc84a6991f0fc73c25498d023b07d488dd5e4238ed9b0c Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-778cbf697c-jgk2s content-length 18436 x-served-by cache-chi-klot8100104-CHI, cache-cph2320045-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:36:00 GMT server nginx x-timer S1721290833.432278,VS0,VE4 etag "66958830-4804" content-type font/woff access-control-allow-origin * x-styx-req-id 16ff6e58-4345-11ef-8edb-c281824f74e2 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H2	200	Hoves_Italic.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	19 KB 19 KB	63ms 51ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Italic.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 8709e66f3192aac47989a4f2c826afc3062b52de3cd792115cba3314c05656c6 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-7qhbq content-length 19656 x-served-by cache-chi-klot8100074-CHI, cache-cph2320044-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290833.432246,VS0,VE4 etag "6695882f-4cc8" content-type font/woff access-control-allow-origin * x-styx-req-id 16fecca0-4345-11ef-a73a-5adf03037691 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H2	200	Hoves_Light.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	18 KB 18 KB	67ms 55ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5390daebe4fc263953ae2cd18f060ebb4aaef20d9df443a4d784cc642ed1eaf2 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-778cbf697c-x5pqn content-length 18600 x-served-by cache-chi-kigq8000086-CHI, cache-cph2320034-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290833.432219,VS0,VE4 etag "6695882f-48a8" content-type font/woff access-control-allow-origin * x-styx-req-id 16ffed9d-4345-11ef-9849-f21714ecd673 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H2	200	Hoves_Light_Italic.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	19 KB 19 KB	135ms 123ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_Light_Italic.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash d88c03f60c9b0c3b3a4a929ad268b6078dda88e59ea5c98eeb16f031ffb0d9e0 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-ghkb8 content-length 19360 x-served-by cache-chi-klot8100179-CHI, cache-cph2320048-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290833.438395,VS0,VE3 etag "6695882f-4ba0" content-type font/woff access-control-allow-origin * x-styx-req-id 16ff45c9-4345-11ef-a39f-4ace80ec767d cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H2	200	Hoves_ExtraLight.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	18 KB 18 KB	133ms 121ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_ExtraLight.woff Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 52239b576d3fdb13fa5cec121a5e5ed123560a4ac1310d991f4694bcc5507710 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-778cbf697c-czhxs content-length 17944 x-served-by cache-chi-kigq8000066-CHI, cache-cph2320051-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290833.438393,VS0,VE3 etag "6695882f-4618" content-type font/woff access-control-allow-origin * x-styx-req-id 16ff4e24-4345-11ef-84ac-ba0dcdbb94b4 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H2	200	throbber-inactive.png www.forcepoint.com/misc/	140 B 526 B	56ms 40ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/throbber-inactive.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b48a895c0170a7310b29b01897fcf1954b43655748ce98037abae38562754a29 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 481, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240195 age 1320989 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=320 idim=15x13 ifmt=png ofsz=140 odim=15x13 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-6m95f content-length 140 x-served-by cache-chi-kigq8000107-CHI, cache-ams2100108-AMS, cache-ams2100108-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.660655,VS0,VE1 etag "CYYfXWQxa+SPObSsE32Xk7Do+LMPmm8BZYCZJK1ZEUA" vary Accept content-type image/webp x-styx-req-id efe84d4d-38da-11ef-bda3-7a520cdabf04 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Jul 2025 01:24:05 GMT
GET H2	200	throbber-active.gif www.forcepoint.com/misc/	1 KB 2 KB	55ms 39ms	Image image/gif	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/throbber-active.gif Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 4d58ffb4437135b1a4f7b8cbf01321ea85fe244416aed493ea942462f3d58c86 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 1105, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240196 age 2611288 http_x_geo_region DE-BY x-cache MISS, HIT, HIT, HIT fastly-io-info ifsz=1233 idim=15x13 ifmt=gif ofsz=1233 odim=15x13 ofmt=gif ofrm=12 http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-6f444b4778-vqrq7 content-length 1233 fastly-io-warning Failed to shrink image x-served-by cache-chi-klot8100061-CHI, cache-ams2100089-AMS, cache-ams2100095-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.661058,VS0,VE0 etag "cciM0uPCYoc09vCSqOmHV4nMniFUM15FCTn0mYxlwCQ" vary Accept content-type image/gif x-styx-req-id 0a09d030-23ae-11ef-9e02-ea1b49524294 cache-control max-age=31622400 accept-ranges bytes expires Sat, 07 Jun 2025 02:39:47 GMT
GET H2	200	grippie.png www.forcepoint.com/misc/	56 B 556 B	53ms 37ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/grippie.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f7d4d17ef4f0103008287290e9dd7bb35be1d08f0f8bc315033d13d0cfa6a6a5 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 1696, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img05-europe-west3 age 2034167 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=106 idim=27x5 ifmt=png ofsz=56 odim=27x5 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-7c9db67975-rt77l content-length 56 x-served-by cache-chi-klot8100115-CHI, cache-ams21073-AMS, cache-ams21073-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.661183,VS0,VE1 etag "kt9RZLYHWjv58VxK34gY2gtJI3NheIs+DTYX4JV5AGA" vary Accept content-type image/webp x-styx-req-id 990fb7eb-120a-11ef-a0cc-d636790e30db cache-control max-age=31622400 accept-ranges bytes expires Thu, 15 May 2025 15:56:59 GMT
GET H2	200	draggable.png www.forcepoint.com/misc/	268 B 680 B	54ms 38ms	Image image/png	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/draggable.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 10aa7853a3babe185246e6f1fad2c5800902a268dd63b66c53b96889ee5188f3 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 183, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240193 age 723097 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=268 idim=15x60 ifmt=png ofsz=268 odim=15x60 ofmt=png http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-m7qcg content-length 268 fastly-io-warning Failed to shrink image x-served-by cache-chi-kigq8000056-CHI, cache-ams21022-AMS, cache-ams21022-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.661052,VS0,VE0 etag "KWIpRFdw6XY1xKLUIvevvjFCVB7MVHDdktcCcAkddP0" vary Accept content-type image/png x-styx-req-id 028015a9-3e4b-11ef-8cd9-222e41344d78 cache-control max-age=31622400 accept-ranges bytes expires Thu, 10 Jul 2025 23:28:55 GMT
GET H2	200	tree.png www.forcepoint.com/misc/	82 B 401 B	69ms 54ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/tree.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 69a02b48768b8f413fe8470c65b4232a39dc3d68350f1246da8721e92ac7e75d Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 710, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240193 age 5042021 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=130 idim=80x81 ifmt=png ofsz=82 odim=80x81 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-7d5d4db597-dqfkt content-length 82 x-served-by cache-chi-kigq8000035-CHI, cache-ams21043-AMS, cache-ams21043-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.662961,VS0,VE0 etag "Z35FTfoaAVemLhiXshryO4rkEzH1KA6bO8GIRsSVaO0" vary Accept content-type image/webp x-styx-req-id 3bc0241e-1703-11ef-911d-fa2fe945313b cache-control max-age=31622400 accept-ranges bytes expires Wed, 21 May 2025 23:46:52 GMT
GET H2	200	tree-bottom.png www.forcepoint.com/misc/	78 B 553 B	67ms 53ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/tree-bottom.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash bfcc07136dc1faaee36973ca4858e530e403f2f41948fbdc47f0c3c399308db6 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 1399, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img08-europe-west2 age 1933314 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=129 idim=80x81 ifmt=png ofsz=78 odim=80x81 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-867f44b44b-5wssg content-length 78 x-served-by cache-chi-klot8100109-CHI, cache-ams21021-AMS, cache-ams21028-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.663453,VS0,VE0 etag "JyOt5s8au+dKwuKYWT9ybz2cVW6ZbelcJx3DlTABXvE" vary Accept content-type image/webp x-styx-req-id eef36650-074f-11ef-8b93-f2f52e1bfc3f cache-control max-age=31622400 accept-ranges bytes expires Fri, 02 May 2025 00:15:36 GMT
GET H2	200	message-24-ok.png www.forcepoint.com/misc/	902 B 1 KB	56ms 42ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/message-24-ok.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 4c8537e1208918b04f3b7970b4e53d6c91b138b7b8325b469a4a5e84ced6ce2a Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 13, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240196 age 1215736 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=1058 idim=24x24 ifmt=png ofsz=902 odim=24x24 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-69d957dcb5-hzqfw content-length 902 x-served-by cache-chi-klot8100043-CHI, cache-ams21058-AMS, cache-ams21058-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.662007,VS0,VE0 etag "60PoYDt+1vFXU4yAkaVKB1clxMNlUR3MuNzEGSZ9U9Y" vary Accept content-type image/webp x-styx-req-id 0a0dcb57-23ae-11ef-bb72-82eb5061f947 cache-control max-age=31622400 accept-ranges bytes expires Sat, 07 Jun 2025 02:39:47 GMT
GET H2	200	message-24-warning.png www.forcepoint.com/misc/	612 B 960 B	66ms 51ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/message-24-warning.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash bd74c29617fed2dbd2f684dce7eebb659567ce0ae06be3418615ebe846a1bf5b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 848, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img09-europe-west2 age 3504748 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=753 idim=24x24 ifmt=png ofsz=612 odim=24x24 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-867f44b44b-2snzw content-length 612 x-served-by cache-chi-klot8100163-CHI, cache-ams21073-AMS, cache-ams12751-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.662750,VS0,VE1 etag "etN9kWF1zriHIse4xor9Tv/e40PLoR3lRGg8xe6tRQE" vary Accept content-type image/webp x-styx-req-id 38c734ce-074c-11ef-bd21-e6711c542c27 cache-control max-age=31622400 accept-ranges bytes expires Thu, 01 May 2025 23:49:02 GMT
GET H2	200	message-24-error.png www.forcepoint.com/misc/	614 B 961 B	66ms 52ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/message-24-error.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 496d9a19dda325d9587f3729b5a16b1262f91a6b237e1aa5d54ed90e087c35e3 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 339, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img03-europe-west3 age 1381539 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=733 idim=24x24 ifmt=png ofsz=614 odim=24x24 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-777f57d6b4-nr2qv content-length 614 x-served-by cache-chi-kigq8000043-CHI, cache-ams21042-AMS, cache-ams12747-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.663404,VS0,VE0 etag "gVoMZ8dd1QgL/2SjIwn0GwzJENiBt143AYaoiF4Ws6M" vary Accept content-type image/webp x-styx-req-id 6d90d03b-1eb1-11ef-92d1-b65dd15c85b7 cache-control max-age=31622400 accept-ranges bytes expires Sat, 31 May 2025 18:21:26 GMT
GET H2	200	help.png www.forcepoint.com/misc/	192 B 582 B	55ms 41ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/help.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f8c79df7183de5a0687fc40c5a9b1034d074e603d558c05a5311c7f91d9ccfe1 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 219, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img04-europe-west3 age 2936507 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=294 idim=16x16 ifmt=png ofsz=192 odim=16x16 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-766d899d75-s659g content-length 192 x-served-by cache-chi-klot8100132-CHI, cache-ams21075-AMS, cache-ams21052-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.662726,VS0,VE0 etag "v6al66PXjd/2WqSfHyL2pCCxkfKAcJfvgCU3I6pbO+4" vary Accept content-type image/webp x-styx-req-id 46289daa-1dfa-11ef-b597-b682643632dc cache-control max-age=31622400 accept-ranges bytes expires Fri, 30 May 2025 20:30:22 GMT
GET H2	200	menu-expanded.png www.forcepoint.com/misc/	46 B 416 B	60ms 46ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/menu-expanded.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5cfc739598cda856cc20575229f8a5251e8df5b175830fe7886aaef79dfb6886 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 994, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240192 age 3216306 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=106 idim=7x7 ifmt=png ofsz=46 odim=7x7 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-7dd7d79886-tt5q8 content-length 46 x-served-by cache-chi-klot8100163-CHI, cache-ams21056-AMS, cache-ams12749-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.661953,VS0,VE0 etag "lnOeF6KlRRR5aM+MCm3C8DB9Vu1cySrSTIEOJY+eTS4" vary Accept content-type image/webp x-styx-req-id 61f9c634-1310-11ef-9bbf-f20de0f2e948 cache-control max-age=31622400 accept-ranges bytes expires Fri, 16 May 2025 23:10:55 GMT
GET H2	200	menu-collapsed.png www.forcepoint.com/misc/	46 B 376 B	65ms 53ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/menu-collapsed.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 521bfd25b076ada01d23b9d20bca3a3e67840702ca4d43b73d0a496575107e9e Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 512, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img03-europe-west3 age 1320988 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=105 idim=7x7 ifmt=png ofsz=46 odim=7x7 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-55987d54bd-mpj8p content-length 46 x-served-by cache-chi-kigq8000091-CHI, cache-ams21028-AMS, cache-ams21028-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.663658,VS0,VE0 etag "HJgRuOhWhAFgOazVOW2HjRFb16cHmG+HSX+vLor86a0" vary Accept content-type image/webp x-styx-req-id 90096ed5-2bfe-11ef-964c-ce0c78ab2c1c cache-control max-age=31622400 accept-ranges bytes expires Tue, 17 Jun 2025 16:36:21 GMT
GET H2	200	progress.gif www.forcepoint.com/misc/	6 KB 6 KB	55ms 43ms	Image image/gif	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/misc/progress.gif Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 91997f03543fdd296c85e60feede1e3df0e950aca03698583ff2870869a2dc0b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 437, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240194 age 2871859 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=5872 idim=20x40 ifmt=gif ofsz=5872 odim=20x40 ofmt=gif ofrm=20 http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-845bccb87b-srflh content-length 5872 fastly-io-warning Failed to shrink image x-served-by cache-chi-klot8100021-CHI, cache-ams2100134-AMS, cache-ams2100134-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.661931,VS0,VE1 etag "KSQIcjJuPSqTVV6Yjqa330VSb5j46NEcKLjR3ejGL1A" vary Accept content-type image/gif x-styx-req-id 883e9816-24d4-11ef-a75e-a2ab8c7907d3 cache-control max-age=31622400 accept-ranges bytes expires Sun, 08 Jun 2025 13:47:50 GMT
GET H2	200	chosen-sprite.png www.forcepoint.com/sites/all/libraries/chosen/	430 B 907 B	57ms 45ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/libraries/chosen/chosen-sprite.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9cc77ec166565cf138f088e29b263d7de28ebff89c6ac6ac7b3226b8c2c45f33 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 558, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240195 age 1998716 http_x_geo_region DE-BY x-cache HIT, HIT, HIT, HIT fastly-io-info ifsz=538 idim=52x37 ifmt=png ofsz=430 odim=52x37 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-69d957dcb5-vfj67 content-length 430 x-served-by cache-chi-klot8100058-CHI, cache-ams21024-AMS, cache-ams2100140-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.661934,VS0,VE0 etag "pCuJ3WEDsPQPzkbIkY90U4TfuAo3yBgHEEN2IOPELGY" vary Accept content-type image/webp x-styx-req-id eade0401-22ce-11ef-bdfd-06c82f407e68 cache-control max-age=31622400 accept-ranges bytes expires Fri, 06 Jun 2025 00:02:37 GMT
GET H2	200	chosen-sprite@2x.png www.forcepoint.com/sites/all/libraries/chosen/	628 B 1 KB	58ms 47ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/libraries/chosen/chosen-sprite@2x.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5f4e0577cb49e1130ec7098698e3556c0a2b7f33d02ec5789ee09b116e403f7e Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 296, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240195 age 3470729 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=738 idim=104x74 ifmt=png ofsz=628 odim=104x74 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-845bccb87b-sj8m2 content-length 628 x-served-by cache-chi-klot8100088-CHI, cache-ams2100105-AMS, cache-ams2100105-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.661897,VS0,VE1 etag "1954vZ3omyWtqZWjx3EPpQPU3ZMgJvFFfwvKeF5rhm0" vary Accept content-type image/webp x-styx-req-id aeb22e9c-254d-11ef-9018-c6b4fe859977 cache-control max-age=31622400 accept-ranges bytes expires Mon, 09 Jun 2025 04:15:04 GMT
GET H2	200	ui-bg_flat_75_ffffff_40x100.png www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/	44 B 418 B	61ms 50ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_flat_75_ffffff_40x100.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash db7de84263a6dfe6f7a674f478b4a6c5a97d7de7e0c7f52a12a5dedfb201004f Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 185, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240196 age 3526288 http_x_geo_region DE-BY x-cache HIT, HIT, HIT, HIT fastly-io-info ifsz=178 idim=40x100 ifmt=png ofsz=44 odim=40x100 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-845bccb87b-srflh content-length 44 x-served-by cache-chi-kigq8000066-CHI, cache-ams2100113-AMS, cache-ams2100113-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.662709,VS0,VE0 etag "O9SdHkbja5Mmzi4DWOWJdZgUQirITGa5uuAK5R/QoyM" vary Accept content-type image/webp x-styx-req-id 52f9a834-24cc-11ef-a75e-a2ab8c7907d3 cache-control max-age=31622400 accept-ranges bytes expires Sun, 08 Jun 2025 12:49:05 GMT
GET H2	200	ui-bg_highlight-soft_75_cccccc_1x100.png www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/	54 B 531 B	62ms 51ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_highlight-soft_75_cccccc_1x100.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b4229c88ccc9ec00268d759c808bb5fc56a62479618d140eebd7948299a1544b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 1, 0, 1101, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img03-europe-west2 age 2623476 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=101 idim=1x100 ifmt=png ofsz=54 odim=1x100 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-867f44b44b-z9kn6 content-length 54 x-served-by cache-chi-kigq8000036-CHI, cache-ams21053-AMS, cache-ams12766-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.662689,VS0,VE0 etag "SVL3LfYtpcUTzNEo8mHT+EoBDkNcvK2l7xiLlLE7P6w" vary Accept content-type image/webp x-styx-req-id 79be48f5-07bc-11ef-b06b-3246cedab68e cache-control max-age=31622400 accept-ranges bytes expires Fri, 02 May 2025 13:12:34 GMT
GET H2	200	ui-bg_glass_75_e6e6e6_1x400.png www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/	78 B 541 B	66ms 55ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_e6e6e6_1x400.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e68e4b1057684aa14f6d44055bd77c6ee8170be28010b94e0278e2d05775973c Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 41, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240193 age 113177 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=110 idim=1x400 ifmt=png ofsz=78 odim=1x400 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-55987d54bd-jlljf content-length 78 x-served-by cache-chi-kigq8000098-CHI, cache-ams2100107-AMS, cache-ams2100107-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.664133,VS0,VE0 etag "4s1MwOZKDfGEu/a/SFo57USn639l3MbW8dYbzZPyEag" vary Accept content-type image/webp x-styx-req-id f46b22cf-2da6-11ef-adfe-b69ccf9e7a36 cache-control max-age=31622400 accept-ranges bytes expires Thu, 19 Jun 2025 19:14:16 GMT
GET H2	200	ui-bg_glass_75_dadada_1x400.png www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/	84 B 454 B	59ms 48ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/modules/contrib/jquery_update/replace/ui/themes/base/minified/images/ui-bg_glass_75_dadada_1x400.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c16c2e899bbe232a64c1bd49e4312a7f9ea738cb2cb17058e63477a71b246fa7 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 777, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240195 age 3032069 http_x_geo_region DE-BY x-cache HIT, HIT, HIT, HIT fastly-io-info ifsz=111 idim=1x400 ifmt=png ofsz=84 odim=1x400 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-845bccb87b-c7w7c content-length 84 x-served-by cache-chi-klot8100024-CHI, cache-ams21038-AMS, cache-ams21038-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.664134,VS0,VE0 etag "msf+sm6St45S//5aPCnGaIqq4DmKLsS3uxv+ikcGyuY" vary Accept content-type image/webp x-styx-req-id 0490b650-294b-11ef-91a4-f680ab016c03 cache-control max-age=31622400 accept-ranges bytes expires Sat, 14 Jun 2025 06:06:04 GMT
GET H2	200	css__YZMmyCjxADNsxWJVyzxskiYBiPsGboww8DDJoAv1iVA__PqGVjSeXe3e-YM4xspxCavDlyydtEB28TRpZPTEwV5I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	6 KB 2 KB	59ms 47ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__YZMmyCjxADNsxWJVyzxskiYBiPsGboww8DDJoAv1iVA__PqGVjSeXe3e-YM4xspxCavDlyydtEB28TRpZPTEwV5I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 942ba1b657ab7477bc603f7852ff551aa393de40d1bab2dee01c8ad36d538a2a Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-vp8bw content-length 2109 x-served-by cache-chi-kigq8000159-CHI, cache-cph2320037-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:05:49 GMT server nginx x-timer S1721290833.431641,VS0,VE4 etag W/"65e6b63d-1797" vary Accept-Encoding content-type text/css x-styx-req-id e591bfd4-f1d7-11ee-835d-6255bad32892 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	css__qi8YWDPFPT47Hua3Uo8V-CwYV79O8gYOw4xRshlFw2o__U0zx4V0QLKPamBJbsVKK0D54d038-KcpyqeXppQL9AI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	11 KB 3 KB	95ms 90ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__qi8YWDPFPT47Hua3Uo8V-CwYV79O8gYOw4xRshlFw2o__U0zx4V0QLKPamBJbsVKK0D54d038-KcpyqeXppQL9AI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 74d6ee660ac8d18d3940eefac6e8c0ff029ecc0f4a4799ada5d6088fe9abfbc8 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Mon, 28 Apr 2025 10:38:01 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-867f44b44b-6zx56 content-length 2662 x-served-by cache-chi-kigq8000165-CHI, cache-cph2320042-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:43 GMT server nginx x-timer S1721290833.431824,VS0,VE4 etag W/"65e6b637-2d9a" vary Accept-Encoding content-type text/css x-styx-req-id 387529c2-0482-11ef-be95-3a8be9a6877a cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	css__umS_7iB8OLqD-AIc28jz7stMtgRnPBrMHXbg802aJVI__42_FYiRnR5OQaV2U3Sr9cY21EIjnMGdJsPXMEFLQPCo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	789 B 748 B	53ms 48ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__umS_7iB8OLqD-AIc28jz7stMtgRnPBrMHXbg802aJVI__42_FYiRnR5OQaV2U3Sr9cY21EIjnMGdJsPXMEFLQPCo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 76fea4cad87ffbee4d6c0d29a46382913e4a8c56ed7881d8556f684a174d6824 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Wed, 25 Jun 2025 19:24:10 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-w9nrv content-length 405 x-served-by cache-chi-kigq8000114-CHI, cache-cph2320021-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:43 GMT server nginx x-timer S1721290833.431808,VS0,VE3 etag W/"65e6b637-315" vary Accept-Encoding content-type text/css x-styx-req-id 552aad89-325f-11ef-b993-de70e4427182 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	css__T7twZATSz9YDtA4CEs3XoRq-lmvsWC1-9rzLrGpoWuY__jYMOyCwkeeWX4KvLeu7GhjzHVkW5HDKp2hWWBDkyRSE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	14 KB 3 KB	129ms 123ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__T7twZATSz9YDtA4CEs3XoRq-lmvsWC1-9rzLrGpoWuY__jYMOyCwkeeWX4KvLeu7GhjzHVkW5HDKp2hWWBDkyRSE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 76aefb325bdfaf3c67be7591a00c96105ffa1a3eda8cfc16d6d5e1affa8e3f95 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 48, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-kk5rj content-length 2632 x-served-by cache-chi-klot8100179-CHI, cache-cph2320053-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Tue, 05 Mar 2024 06:05:45 GMT server nginx x-timer S1721290833.438400,VS0,VE4 etag W/"65e6b639-3962" vary Accept-Encoding content-type text/css x-styx-req-id d721e3ae-f1d7-11ee-b87b-f2654297ce89 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:02 GMT
GET H2	200	css__cPPXTJ7LS3TkqOr2dWhu9Zyqf3tfJ7ROJIBrc4faLpI__FwTXCQ-S705F3IVDki0NUMzBJ8oRlS2Lb0Atw9pp7LE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	512 B 627 B	98ms 92ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__cPPXTJ7LS3TkqOr2dWhu9Zyqf3tfJ7ROJIBrc4faLpI__FwTXCQ-S705F3IVDki0NUMzBJ8oRlS2Lb0Atw9pp7LE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9b3c52df9ce6473c11ee62f85cd48a7ff2b24ad8543ed415fec5124605a987f3 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-m255z content-length 230 x-served-by cache-chi-kigq8000068-CHI, cache-cph2320025-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:05:46 GMT server nginx x-timer S1721290833.437873,VS0,VE3 etag W/"65e6b63a-200" vary Accept-Encoding content-type text/css x-styx-req-id d804a972-f1d7-11ee-976d-4e9dd3d547b2 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:03 GMT
GET H2	200	css__RtPfTjThw7JiCEZr8aCFs0ovY-ZonvJYBpW2tzv6iRI__hoYIfBUPIWctuKqU_lrnnqDtJnf9B9QEu7jjix36RIM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	3 KB 1 KB	130ms 124ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__RtPfTjThw7JiCEZr8aCFs0ovY-ZonvJYBpW2tzv6iRI__hoYIfBUPIWctuKqU_lrnnqDtJnf9B9QEu7jjix36RIM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5f8d1adf76eaaf2f3592e5a5633ef8722740af2424b1737d85c1d9581588884f Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Fri, 27 Jun 2025 04:07:49 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-l749x content-length 1172 x-served-by cache-chi-kigq8000154-CHI, cache-cph2320040-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:52 GMT server nginx x-timer S1721290833.437856,VS0,VE4 etag W/"65e6b640-c8c" vary Accept-Encoding content-type text/css x-styx-req-id a6a59393-3371-11ef-8b05-0e97991a7547 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	css__UYLIEJhZ7iPfgPAKjuslVw3CRCFKt3OfxTJjge8A6Hg__fjua13AgyzmqodcGsNUIVue50ndbutts1ntJbzGK_o4__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	506 B 580 B	128ms 123ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__UYLIEJhZ7iPfgPAKjuslVw3CRCFKt3OfxTJjge8A6Hg__fjua13AgyzmqodcGsNUIVue50ndbutts1ntJbzGK_o4__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 4953a30def5d6eb8aa0119f918104b5069d10696ee634288c068accf06bb44e6 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 23, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-fn6sp content-length 175 x-served-by cache-chi-kigq8000153-CHI, cache-cph2320059-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Tue, 05 Mar 2024 06:05:53 GMT server nginx x-timer S1721290833.438391,VS0,VE4 etag W/"65e6b641-1fa" vary Accept-Encoding content-type text/css x-styx-req-id e596f71a-f1d7-11ee-89fc-2e39b17a00a2 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	css__aUSIons1JLpznAkAWe4wYFCe4_fmTTJTOhtdC4xIAuM__HAl4ITsYWBEO7VRahEwWwi88zkLUBwPm3j4nnx8DeS0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	454 B 564 B	126ms 120ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__aUSIons1JLpznAkAWe4wYFCe4_fmTTJTOhtdC4xIAuM__HAl4ITsYWBEO7VRahEwWwi88zkLUBwPm3j4nnx8DeS0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash fe9132775150b13960723fdffd15ef8bb7f07d120787874114ac9e3d4f303f46 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sun, 22 Jun 2025 00:18:26 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-56d7969b4f-msw7d content-length 221 x-served-by cache-chi-kigq8000054-CHI, cache-cph2320040-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:54 GMT server nginx x-timer S1721290833.437831,VS0,VE4 etag W/"65e6b642-1c6" vary Accept-Encoding content-type text/css x-styx-req-id c778cb20-2f63-11ef-9f89-ba784693dba0 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	css__DJVWsB9CJVs_1IGdy-_cGuq4r6SVVaWbEnbS1U2p6y4__7g40UeM74r8hkrzDC6Hbb7RReIGNu-Jsb5XAbAPKIeA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	502 B 494 B	99ms 93ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__DJVWsB9CJVs_1IGdy-_cGuq4r6SVVaWbEnbS1U2p6y4__7g40UeM74r8hkrzDC6Hbb7RReIGNu-Jsb5XAbAPKIeA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b9c823db89be14289e3b0585970e3d91c3313ec9f82d13c9cb24d90820efc699 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Tue, 03 Jun 2025 10:17:05 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-766d899d75-fzdtp content-length 252 x-served-by cache-chi-klot8100023-CHI, cache-cph2320046-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:55 GMT server nginx x-timer S1721290833.437817,VS0,VE3 etag W/"65e6b643-1f6" vary Accept-Encoding content-type text/css x-styx-req-id 42eebcb4-20c9-11ef-a8e2-12b292f98399 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	css__o5tk1Sc0QNaikp-qb6PDIJi_LXPkfQZHTxlvWxiG4cA__afd6HnnR0psI0sfippmnwgZS958AUTsIqEne3K05XvQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	5 KB 2 KB	125ms 120ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__o5tk1Sc0QNaikp-qb6PDIJi_LXPkfQZHTxlvWxiG4cA__afd6HnnR0psI0sfippmnwgZS958AUTsIqEne3K05XvQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 7e9433a7e4538237be585d3d84e1603595879c286be61e26dd3e628e3fd5e206 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175859 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-vp8bw content-length 2091 x-served-by cache-chi-klot8100098-CHI, cache-cph2320039-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:05:56 GMT server nginx x-timer S1721290833.437801,VS0,VE4 etag W/"65e6b644-1218" vary Accept-Encoding content-type text/css x-styx-req-id e5943fb9-f1d7-11ee-835d-6255bad32892 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	css__ZDvn-N8wxxyBR7KgfbRzIHM0mGwT9doN0fs3f10b_Go__b98SsVi1Bn9KY5Ur3SIgLXOvEMppxbzl1YiFYp9d4Lw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	128 B 416 B	108ms 103ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__ZDvn-N8wxxyBR7KgfbRzIHM0mGwT9doN0fs3f10b_Go__b98SsVi1Bn9KY5Ur3SIgLXOvEMppxbzl1YiFYp9d4Lw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c712b85f4d57c41bb049c80303067da9790aa76b32a41b422174bd507695f444 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-j9qgk content-length 118 x-served-by cache-chi-klot8100059-CHI, cache-cph2320022-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:05:47 GMT server nginx x-timer S1721290833.437786,VS0,VE4 etag W/"65e6b63b-80" vary Accept-Encoding content-type text/css x-styx-req-id e599bfb1-f1d7-11ee-8caf-72f948985f1d cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	css__dn-cpI1YtkU_iLHgA5WhlkxgYWyat_IxjF_B-WSYrpE__a9hIbt0eaZ7d5nhwnm2weG8R_2eXK4EvoOx9dOxouHE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	203 B 427 B	97ms 92ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__dn-cpI1YtkU_iLHgA5WhlkxgYWyat_IxjF_B-WSYrpE__a9hIbt0eaZ7d5nhwnm2weG8R_2eXK4EvoOx9dOxouHE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f66578f61dcd2d00bb8b7a0c5a7a02d39871c2e7c4615826c4e3a6a879a1a66b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Wed, 11 Jun 2025 01:59:45 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-845bccb87b-s649l content-length 137 x-served-by cache-chi-klot8100122-CHI, cache-cph2320044-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:56 GMT server nginx x-timer S1721290833.437773,VS0,VE3 etag W/"65e6b644-cb" vary Accept-Encoding content-type text/css x-styx-req-id 1c673fac-26cd-11ef-a8ca-6e88d504bb51 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 45, 9, 0
GET H2	200	css__ipUqqBUxEUOLXG_AXF5OCY1hi5eq8oz7Wu0QleOzxj4__-6ZHnf2EVvcL4izgd6S5myiQ-LuyKAuDqa-1hfKmAoI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	99 B 451 B	99ms 95ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__ipUqqBUxEUOLXG_AXF5OCY1hi5eq8oz7Wu0QleOzxj4__-6ZHnf2EVvcL4izgd6S5myiQ-LuyKAuDqa-1hfKmAoI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a0d9d290c9928affdd7f2816a574b367cbd6aca7ff1ba7b14b3391330d6f1995 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Wed, 11 Jun 2025 11:24:22 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-845bccb87b-srflh content-length 100 x-served-by cache-chi-klot8100084-CHI, cache-cph2320056-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:58 GMT server nginx x-timer S1721290833.437760,VS0,VE4 etag W/"65e6b646-63" vary Accept-Encoding content-type text/css x-styx-req-id fc2a0d8d-271b-11ef-a75e-a2ab8c7907d3 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 81, 9, 0
GET H2	200	css__A19mhhFH8iX9Ft_oM_oZIcxue6YTAguNiWQN5VaIXQY__dFQUh1vb7jTgHR4jKzrw8DrsdYIarxRbpVmMKCWYgXU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	493 KB 118 KB	100ms 96ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__A19mhhFH8iX9Ft_oM_oZIcxue6YTAguNiWQN5VaIXQY__dFQUh1vb7jTgHR4jKzrw8DrsdYIarxRbpVmMKCWYgXU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 24dd593caf98fe7183e48e16a5a827ab4eb1a734a9821b497689127e68774db1 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sun, 06 Jul 2025 23:26:15 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-x24lf content-length 120174 x-served-by cache-chi-kigq8000100-CHI, cache-cph2320041-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:48 GMT server nginx x-timer S1721290833.437739,VS0,VE4 etag W/"65e6b63c-7b4f7" vary Accept-Encoding content-type text/css x-styx-req-id f9a37d6a-3b25-11ef-a111-0a5f4b927256 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	2 MB 301 KB	109ms 105ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 8117b5d7ba159bfb0cf341d96a566b4b06c466a0038eca2273a8533b1536e019 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sat, 21 Jun 2025 13:27:13 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 173551 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-56d7969b4f-nzfgb content-length 307198 x-served-by cache-chi-kigq8000037-CHI, cache-cph2320040-CPH, cache-cph2320055-CPH last-modified Thu, 20 Jun 2024 13:27:07 GMT server nginx x-timer S1721290833.437729,VS0,VE4 etag W/"66742e2b-1f7287" vary Accept-Encoding content-type text/css x-styx-req-id ce42fc2e-2f08-11ef-b403-3a4931867672 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	forcepoint.svg www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/	2 KB 1 KB	128ms 124ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/forcepoint.svg Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c7397ae13ad9d12bf4ce9100756dd8703b515ac4381bdd33638e22c787c0fb39 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 21, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-jjllv content-length 783 x-served-by cache-chi-klot8100172-CHI, cache-cph2320046-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:36:00 GMT server nginx x-timer S1721290833.469427,VS0,VE4 etag W/"66958830-6ad" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id 1708bde2-4345-11ef-bfff-92b70a8cdf9e cache-control max-age=31622400 accept-ranges bytes expires Thu, 17 Jul 2025 07:29:09 GMT
GET H2	200	css___VkyRO3B5Aq6aNIr0ttm3Is69Rc7XYN_AdFjRz9E6sA__VcIbQquJvVVOuzIFHQnbacZLWNY0lFxoxf5twuCo0Bc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css www.forcepoint.com/sites/default/files/advagg_css/	6 KB 2 KB	188ms 183ms	Stylesheet text/css	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_css/css___VkyRO3B5Aq6aNIr0ttm3Is69Rc7XYN_AdFjRz9E6sA__VcIbQquJvVVOuzIFHQnbacZLWNY0lFxoxf5twuCo0Bc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ee27e3cdc69e172aac4b82b3f20d30a2e9b8fc56e7154475292f0ce338b8a5a5 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sat, 05 Jul 2025 06:37:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175883 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-llvxv content-length 1421 x-served-by cache-chi-kigq8000092-CHI, cache-cph2320025-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:59 GMT server nginx x-timer S1721290834.700972,VS0,VE3 etag W/"65e6b647-19a6" vary Accept-Encoding content-type text/css x-styx-req-id d63b43a8-39cf-11ef-ab89-ee120c8775da cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	about_us_0.svg www.forcepoint.com/sites/default/files/	2 KB 1 KB	112ms 112ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/about_us_0.svg?itok=3xrS9jXe Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 98bee51ffbb032cfea01030abf23549c6d762f6d8283599e52bfb089f01b8742 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-8gp4k content-length 866 x-served-by cache-chi-kigq8000108-CHI, cache-cph2320021-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Wed, 18 Oct 2023 11:53:36 GMT server nginx x-timer S1721290833.469412,VS0,VE4 etag W/"652fc740-76e" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id d8a73d5e-f1d7-11ee-96a4-d2ef4ea261cb cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:05 GMT
GET H2	200	our_approach_0.svg www.forcepoint.com/sites/default/files/	3 KB 1 KB	50ms 47ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/our_approach_0.svg?itok=XjvgKmGS Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3058f7c617c39b1a94849fa7223c2f756437af3f215155d37c2a29c36848e28d Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-p72wq content-length 1012 x-served-by cache-chi-klot8100045-CHI, cache-cph2320032-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Wed, 18 Oct 2023 11:53:58 GMT server nginx x-timer S1721290834.566411,VS0,VE3 etag W/"652fc756-a97" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id d725995a-f1d7-11ee-b1db-162c3c5c54d7 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:02 GMT
GET H2	200	our_customers_0.svg www.forcepoint.com/sites/default/files/	2 KB 1 KB	50ms 47ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/our_customers_0.svg?itok=pljm0BZO Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c2a54667fcd4151ef9a27b18f84f24c0b884fe593302ca1eb1210d114f4bd06b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 314, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-z27mm content-length 913 x-served-by cache-chi-kigq8000075-CHI, cache-cph2320036-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Wed, 18 Oct 2023 11:54:19 GMT server nginx x-timer S1721290834.566396,VS0,VE3 etag W/"652fc76b-9af" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id db834eb6-f1d7-11ee-8a97-36bf4d504f37 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:09 GMT
GET H2	200	fp_one_icon_12.svg www.forcepoint.com/sites/default/files/	1 KB 1 KB	60ms 50ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/fp_one_icon_12.svg?itok=mLSyqP7- Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 35, 36, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175885 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-l79x9 content-length 725 x-served-by cache-chi-kigq8000075-CHI, cache-cph2320040-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Mon, 18 Mar 2024 16:01:42 GMT server nginx x-timer S1721290834.662639,VS0,VE4 etag W/"65f86566-5ed" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id db750a4b-f1d7-11ee-a7b0-d6145dabcebb cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:09 GMT
GET H2	200	fp_one_icon-hover_12.svg www.forcepoint.com/sites/default/files/	1 KB 1 KB	68ms 58ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/fp_one_icon-hover_12.svg?itok=lvMOGlA6 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175885 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-kk5rj content-length 737 x-served-by cache-chi-kigq8000131-CHI, cache-cph2320026-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Mon, 18 Mar 2024 16:01:47 GMT server nginx x-timer S1721290834.663704,VS0,VE4 etag W/"65f8656b-5fb" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id db770500-f1d7-11ee-b87b-f2654297ce89 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:09 GMT
GET H2	200	fp_one_icon_0.svg www.forcepoint.com/sites/default/files/	1 KB 1 KB	60ms 48ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/fp_one_icon_0.svg?itok=eKi29PlI Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 13cdee5a7dbdb75ba06271fff8669bb408838d89eae133c2b3db99d2891bb35b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 35, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175885 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-rszwb content-length 725 x-served-by cache-chi-klot8100050-CHI, cache-cph2320046-CPH, cache-cph2320055-CPH last-modified Wed, 18 Oct 2023 11:35:43 GMT server nginx x-timer S1721290834.662630,VS0,VE3 etag W/"652fc30f-5ed" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id a9989269-3901-11ef-ba53-d260c23d87a7 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Jul 2025 06:01:17 GMT
GET H2	200	fp_one_icon-hover_0.svg www.forcepoint.com/sites/default/files/	1 KB 984 B	66ms 54ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/fp_one_icon-hover_0.svg?itok=ecRnPBsZ Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 90bfbf24972d694b303aaa50fe006074f7dd5529c8dfe38099aed648c6312158 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 63, 10, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175885 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-6v4d5 content-length 737 x-served-by cache-chi-kigq8000145-CHI, cache-cph2320023-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Wed, 18 Oct 2023 11:35:50 GMT server nginx x-timer S1721290834.663105,VS0,VE4 etag W/"652fc316-5fb" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id d8a93da4-f1d7-11ee-b900-62d8d57276c4 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:05 GMT
GET H2	200	cyber_edu_icon.svg www.forcepoint.com/sites/default/files/	2 KB 1 KB	194ms 182ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/cyber_edu_icon.svg?itok=XXkKE01K Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash fad8df5718762444a80e745fd3b375ecfee298b37c480de5134b8a0ed05bc7a5 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175885 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-x24lf content-length 813 x-served-by cache-chi-klot8100039-CHI, cache-cph2320050-CPH, cache-cph2320055-CPH last-modified Wed, 18 Oct 2023 12:02:27 GMT server nginx x-timer S1721290834.699810,VS0,VE4 etag W/"652fc953-9a9" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id 649a3ed4-3829-11ef-a111-0a5f4b927256 cache-control max-age=31622400 accept-ranges bytes expires Thu, 03 Jul 2025 04:13:10 GMT
GET H2	200	cyber_edu_icon-hover.svg www.forcepoint.com/sites/default/files/	3 KB 1 KB	126ms 114ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/cyber_edu_icon-hover.svg?itok=ymKcsOZ4 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2528d731c4e61e67f78982f202d1de7e6f7a234117b4d9c98325c27e33c6e1d3 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 63, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-5zbrs content-length 869 x-served-by cache-chi-kigq8000147-CHI, cache-cph2320054-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Wed, 18 Oct 2023 12:02:37 GMT server nginx x-timer S1721290834.699027,VS0,VE4 etag W/"652fc95d-b0c" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id dc5b370e-f1d7-11ee-bbb7-623f168e5bfe cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:11 GMT
GET H2	200	turkish-ransomware-i-hero.png www.forcepoint.com/sites/default/files/styles/1180x346_sc/public/hero/	230 KB 235 KB	220ms 208ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/styles/1180x346_sc/public/hero/turkish-ransomware-i-hero.png?itok=jJ8gZgn8&timestamp=1720786293 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ac549b887c22d68ffc9963e419cb31015a2305200948d06f3ca24c67b1986d81 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report Strict-Transport-Security max-age=18410000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 129, 0 content-security-policy default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report strict-transport-security max-age=18410000; includeSubDomains; preload x-content-type-options nosniff date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish fastly-io-served-by vpop-etou8240192 age 181132 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, MISS fastly-io-info ifsz=271023 idim=1180x346 ifmt=png ofsz=235250 odim=1180x346 ofmt=webp from-origin same, https://analyticsssl.forcepoint.com,https://vidyard.com http_x_geo_continent EU fastly-stats io=1 expires Sun, 19 Nov 1978 05:00:00 GMT content-length 235250 x-xss-protection 1 x-served-by cache-chi-klot8100058-CHI, cache-ams2100113-AMS, cache-ams2100143-AMS, cache-cph2320055-CPH referrer-policy strict-origin-when-cross-origin server nginx x-timer S1721290834.699030,VS0,VE17 etag "ARyepglzjQOVSsVALQBrVpjm+jPHwzXO+BUs0BEKM50" x-frame-options SAMEORIGIN vary Accept content-type image/webp x-styx-req-id 45451697-404b-11ef-9a42-ee9e1dde6fad cache-control no-cache, must-revalidate accept-ranges bytes x-drupal-cache MISS x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-p5mqc
GET H2	200	turkish-ransomware-i-1.png www.forcepoint.com/sites/default/files/	36 KB 37 KB	99ms 88ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-1.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ec5d5e9a8573943abc88da8c47fead83a877d69e64c69b339dbc9a893da055c9 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 42, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img04-europe-west3 age 503083 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=94838 idim=780x546 ifmt=png ofsz=37140 odim=780x546 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-w9nrv content-length 37140 x-served-by cache-chi-klot8100176-CHI, cache-ams21039-AMS, cache-ams2100113-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.700025,VS0,VE0 etag "uNJWYqypNdOFqJmH83PVKUgACyMkCigVg7DzHvW+e3w" vary Accept content-type image/webp x-styx-req-id 4544c800-404b-11ef-9aee-de70e4427182 cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:35:50 GMT
GET H2	200	turkish-ransomware-i-2.png www.forcepoint.com/sites/default/files/	31 KB 31 KB	94ms 82ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-2.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 212f36154bde29fb1769244168fa4f40e77315fffa6ae42fff232062f8ed7a0a Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 40, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240194 age 503994 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=41997 idim=826x110 ifmt=png ofsz=31446 odim=826x110 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-4fsf9 content-length 31446 x-served-by cache-chi-kigq8000172-CHI, cache-ams21033-AMS, cache-ams21074-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.699246,VS0,VE0 etag "jzQ8GBMoXnuRL+FfzQxIWPtysQpwUUT2P4Sh4XwoW5E" vary Accept content-type image/webp x-styx-req-id 26ce45c6-4049-11ef-9bc7-0e47c8ff5b51 cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:20:39 GMT
GET H2	200	turkish-ransomware-i-3.png www.forcepoint.com/sites/default/files/	91 KB 91 KB	98ms 86ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-3.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 83fb1040f8f7dc9b42904b8ea0507b1fec248e2ffa8a0ad32d8f00357e9a01f3 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 45, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240194 age 503992 http_x_geo_region DE-BY x-cache MISS, HIT, HIT, HIT fastly-io-info ifsz=117661 idim=678x288 ifmt=png ofsz=92758 odim=678x288 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-w9nrv content-length 92758 x-served-by cache-chi-klot8100129-CHI, cache-ams2100120-AMS, cache-ams21082-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.700124,VS0,VE0 etag "nozWbhv5GyIfBKBAWhuYwI93wz2hbpGsupWE4bsRPB4" vary Accept content-type image/webp x-styx-req-id 27d07c78-4049-11ef-9aee-de70e4427182 cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:20:41 GMT
GET H2	200	turkish-ransomware-i-4.png www.forcepoint.com/sites/default/files/	201 KB 202 KB	92ms 81ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-4.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2caf6812d133b2fc835155902536bee390fd4dca3f8d6cc7e62f7081e27debf6 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 42, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img04-europe-west3 age 503987 http_x_geo_region DE-BY x-cache MISS, HIT, HIT, HIT fastly-io-info ifsz=257987 idim=651x492 ifmt=png ofsz=205972 odim=651x492 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-m7qcg content-length 205972 x-served-by cache-chi-kigq8000079-CHI, cache-ams21058-AMS, cache-ams21041-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.699379,VS0,VE1 etag "oHWJWJttw0bnLGZnFhZPzYI2EwL+ygi+OHB7hhgxPhY" vary Accept content-type image/webp x-styx-req-id 2a687027-4049-11ef-8cd9-222e41344d78 cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:20:46 GMT
GET H2	200	turkish-ransomware-i-5.png www.forcepoint.com/sites/default/files/	241 KB 241 KB	97ms 85ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-5.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c309dbbe647bbf8904cf5cf33833f02fdc6e00c6bb5a95cdf9f29fac4e662207 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 41, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240196 age 503991 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=455605 idim=654x375 ifmt=png ofsz=246462 odim=654x375 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-p5mqc content-length 246462 x-served-by cache-chi-kigq8000149-CHI, cache-ams21070-AMS, cache-ams21028-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.699167,VS0,VE0 etag "4Ae9OqXfzWlFdFxrwoYhxmMkd/MRxTKqY1mAK5GZXX4" vary Accept content-type image/webp x-styx-req-id 27b7d23b-4049-11ef-9a42-ee9e1dde6fad cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:20:41 GMT
GET H2	200	turkish-ransomware-i-6.png www.forcepoint.com/sites/default/files/	69 KB 70 KB	97ms 86ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-6.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 33b9732e0e2aa2683522382286b86715ec85f147959f352137f49a1d4feb79a0 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 42, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240195 age 503980 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=88301 idim=666x151 ifmt=png ofsz=70858 odim=666x151 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-z4chc content-length 70858 x-served-by cache-chi-klot8100125-CHI, cache-ams2100121-AMS, cache-ams21052-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.699079,VS0,VE0 etag "KbwlYUTXJtoVwKP//Ky7Llr4VG9+FuJ6ur+S0DozwBo" vary Accept content-type image/webp x-styx-req-id 2f326baa-4049-11ef-8ee1-8245d19189a9 cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:20:54 GMT
GET H2	200	turkish-ransomware-i-7.png www.forcepoint.com/sites/default/files/	78 KB 79 KB	98ms 87ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-7.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b59117aaaa77098f07b611fff721f582ad56daaf3a460dc4161c29172632918d Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 40, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240196 age 503993 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=111582 idim=689x271 ifmt=png ofsz=80122 odim=689x271 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-prbvz content-length 80122 x-served-by cache-chi-klot8100088-CHI, cache-ams21052-AMS, cache-ams2100089-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.698983,VS0,VE1 etag "6FlEOaafHr98UWObrJdySNdIam4RI/JaNSHS02D7LOY" vary Accept content-type image/webp x-styx-req-id 271af048-4049-11ef-ad50-1edbf4b9e77b cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:20:40 GMT
GET H2	200	turkish-ransomware-i-8.png www.forcepoint.com/sites/default/files/	129 KB 129 KB	91ms 80ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/turkish-ransomware-i-8.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 23101a57da5bd64dde755399a7f34a1c69bb4addcdfe003a9aa99d3d022483ed Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 41, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by img04-europe-west3 age 503245 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, HIT fastly-io-info ifsz=185201 idim=840x347 ifmt=png ofsz=131744 odim=840x347 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-cr9cd content-length 131744 x-served-by cache-chi-klot8100100-CHI, cache-ams21081-AMS, cache-ams21058-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.698339,VS0,VE1 etag "oXJiF6h7vLunwwxk9Gix0+31TLHd4+ly8lkwGhHkkqY" vary Accept content-type image/webp x-styx-req-id e4f74395-404a-11ef-b3d9-563f282b1988 cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:33:08 GMT
GET H2	200	placeholder_image.png www.forcepoint.com/sites/all/themes/custom/fp/assets/img/	34 B 443 B	98ms 88ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/placeholder_image.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 735b78ae1f09b1d02ee92b5ad319a189d50d10ecbec4ddd12201885dde3f4945 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 191, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240196 age 714594 http_x_geo_region DE-BY x-cache MISS, HIT, HIT, HIT fastly-io-info ifsz=1272 idim=20x20 ifmt=png ofsz=34 odim=20x20 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-p5mqc content-length 34 x-served-by cache-chi-kigq8000157-CHI, cache-ams21022-AMS, cache-ams21022-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.698349,VS0,VE1 etag "1Cw1g26qcqy/qXiETpkqMbr8ayhbr57dIxJ0jC+RrrE" vary Accept content-type image/webp x-styx-req-id ced02715-3e5e-11ef-9a42-ee9e1dde6fad cache-control max-age=31622400 accept-ranges bytes expires Fri, 11 Jul 2025 01:50:38 GMT
GET H2	200	snycu-purple.jpg www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/	19 KB 24 KB	218ms 207ms	Image image/jpeg	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/snycu-purple.jpg?itok=9YaXm6cf&timestamp=1720181106 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 4577c7682212aced0e91a82f5d2e9876a77151bf8f16a8317e8a95fc29c87f8d Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report Strict-Transport-Security max-age=18410000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 483, 0 content-security-policy default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.fonts.net *.licdn.com *.tiqcdn.com *.marketo.com *.marketo.net *.mktoresp.com *.demdex.net *.burly.io *.omtrdc.net *.llnwd.net *.tealiumiq.com *.googleadservices.com *.marinsm.com *.amazonaws.com *.quantserve.com *.facebook.net *.serving-sys.com *.google-analytics.com *.hirebridge.com *.websense.com *.bizographics.com *.linkedin.com *.cloudfront.net *.newrelic.com *.nr-data.net *.adnxs.com *.demandbase.com *.twitter.com *.omtrdc.net *.youtube.com *.ads-twitter.com *.company-target.com *.omniture.com *.doubleclick.net *.forcepoint.com *.google.com *.facebook.com *.nr-data.net *.getsmartcontent.com *.vidyard.com *.adroll.com s.ml-attr.com attr.ml-api.io *.driftt.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.gstatic.com *.libsyn.com *.s3.amazonaws.com *.cdnbasket.net ids.cdnwidget.com app.vwo.com *.visualwebsiteoptimizer.com use.typekit.net p.typekit.net cdn.vwo-analytics.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.googleapis.com *.cloudflare.com activitymap.adobe.com *.consensu.org *.ubembed.com *.bizible.com *.theadex.com *.aumago.com *.driftqa.com *.scribblecdn.net *.esg-global.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.clickagy.com *.nimblestory.com *.usemessages.com *.stackadapt.com *.googlesyndication.com ; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com; img-src * data: *; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.cdnwidget.com *.tealiumiq.com *.google.com *.googleadservices.com *.doubleclick.net *.websense.com *.marinsm.com *.facebook.com *.quantserve.com *.google-analytics.com *.w55c.net *.marketo.com *.iasds01.com *.linkedin.com *.cloudfront.net *.forcepoint.com *.adnxs.com *.twitter.com t.co *.omtrdc.net *.w55c.net *.demandbase.com *.company-target.com *.gstatic.com *.tiqcdn.com *.marketo.net *.newrelic.com *.facebook.net *.ads-twitter.com *.burly.io *.bizographics.com *.nr-data.net *.licdn.com *.tt.omtrdc.net *.getsmartcontent.com *.adroll.com *.vidyard.com s.ml-attr.com *.ml-api.io ml314.com *.ml314.com *.bing.com *.driftt.com *.crazyegg.com *.sharethis.com *.vimeo.com *.slideshare.net *.techvalidate.com *.gartner.com *.googletagmanager.com *.visualwebsiteoptimizer.com app.vwo.com *.ubembed.com *.driftt.com *.vwo-analytics.com *.s3.amazonaws.com s3.amazonaws.com dev-forcepoint.pantheonsite.io test-forcepoint.pantheonsite.io live-forcepoint.pantheonsite.io *.clearbit.com *.googleapis.com *.cloudflare.com *.adobe.com *.consensu.org *.bizible.com *.theadex.com *.aumago.com *.zoominfo.com *.clickagy.com *.redditstatic.com *.quantcount.com *.g2crowd.com *.steelhousemedia.com *.scribblecdn.net *.esg-global.com *.6sc.co *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com *.hubapi.com *.hsforms.net *.hsforms.com geolocation-db.com *.drift.com *.jquery.com *.google.com *.hscollectedforms.net *.jsdelivr.net *.stackadapt.com *.googlesyndication.com *.simpleanalyticscdn.com scripts.simpleanalyticscdn.com queue.simpleanalyticscdn.com simpleanalyticsbadges.com *.ceros.com *.hubspot.com *.hubspot.net *.demdex.net *.libsyn.com *.youtube.com; font-src 'self' *.google.com *.googleadservices.com; connect-src 'self' *.vwo.com *.demdex.net *.omtrdc.net *.mktoresp.com *.cdnbasket.net ids.cdnwidget.com *.forcepoint.com sample-api-v2.crazyegg.com *.visualwebsiteoptimizer.com insight.adsrvr.org bam.nr-data.net *.tealiumiq.com live-evercurrent-clone.pantheonsite.io *.sharethis.com *.doubleclick.net *.theadex.com *.aumago.com *.google-analytics.com *.6sc.co *.adnxs.com *.vidyard.com *.6sense.com *.hs-scripts.com *.hs-analytics.net *.hsadspixel.net *.hs-banner.com api.hubapi.com *.hsforms.net *.hsforms.com *.s3.amazonaws.com *.drift.com *.clickagy.com *.facebook.com *.zoominfo.com geolocation-db.com dn.linkedin.oribi.io *.hubspot.com *.hscollectedforms.net *.stackadapt.com *.google.com *.googletagmanager.com *.googleadservices.com google.com *.googlesyndication.com *.linkedin.com *.redditstatic.com *.reddit.com *.g2crowd.com *.quantcount.com; report-uri /admin/config/system/seckit/csp-report strict-transport-security max-age=18410000; includeSubDomains; preload x-content-type-options nosniff date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish fastly-io-served-by img03-europe-west3 age 1105038 http_x_geo_region DE-BY x-cache MISS, MISS, HIT, MISS fastly-io-info ifsz=19160 idim=570x270 ifmt=jpeg ofsz=19160 odim=570x270 ofmt=jpeg from-origin same, https://analyticsssl.forcepoint.com,https://vidyard.com http_x_geo_continent EU fastly-stats io=1 expires Sun, 19 Nov 1978 05:00:00 GMT content-length 19160 x-xss-protection 1 fastly-io-warning Failed to shrink image x-served-by cache-chi-kigq8000067-CHI, cache-ams21030-AMS, cache-ams21068-AMS, cache-cph2320055-CPH referrer-policy strict-origin-when-cross-origin server nginx x-timer S1721290834.698314,VS0,VE15 etag "FQjOeNVYvcbgpj64kR+6Z0Un7v/CzGkmrYHkIMHOUQ0" x-frame-options SAMEORIGIN vary Accept content-type image/jpeg x-styx-req-id bef221d4-3acd-11ef-9ce6-065f8a95e18c cache-control no-cache, must-revalidate accept-ranges bytes x-drupal-cache MISS x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-ct69k
GET H2	200	remcos.jpg www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/	26 KB 27 KB	98ms 87ms	Image image/jpeg	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/styles/570x270_sc/public/hero/remcos.jpg?itok=GOEjP2Jd&timestamp=1719232019 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 712e59da51ddbfc83c263cc8c2b6a404d9f3ec89e830f11220db390c5a410456 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 22, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240193 age 581359 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=26884 idim=570x270 ifmt=jpeg ofsz=26884 odim=570x270 ofmt=jpeg http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-z4chc content-length 26884 fastly-io-warning Failed to shrink image x-served-by cache-chi-kigq8000149-CHI, cache-ams21078-AMS, cache-ams21078-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.698296,VS0,VE1 etag "Bj6V4XDrta5qWNJIi+Jp/8es/hc89Whhyy6eiztHJ1g" vary Accept content-type image/jpeg x-styx-req-id a9d41264-3235-11ef-8eb8-8245d19189a9 cache-control max-age=31622400 accept-ranges bytes expires Wed, 25 Jun 2025 14:25:53 GMT
GET H2	200	turkish-ransomware-i-hero.png www.forcepoint.com/sites/default/files/styles/footer_menu_featured_blog/public/hero/	18 KB 19 KB	97ms 87ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/styles/footer_menu_featured_blog/public/hero/turkish-ransomware-i-hero.png?itok=aF-78Yax Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 04b512735003d45868136e8382b0835e32e8aa2bbe73634cb6a9059bde1f50de Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 2, 0, 2, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240192 age 504256 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=19611 idim=199x111 ifmt=png ofsz=18888 odim=199x111 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-6m95f content-length 18888 x-served-by cache-chi-klot8100101-CHI, cache-ams21026-AMS, cache-ams21045-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.698277,VS0,VE1 etag "Fgm3d4a68L15hjo7Gl4iPYFNKA/KUbKsa3gsOoPFXtA" vary Accept content-type image/webp x-styx-req-id 8a69eb0e-4048-11ef-a95a-7a520cdabf04 cache-control max-age=31622400 accept-ranges bytes expires Sun, 13 Jul 2025 12:16:17 GMT
GET H2	200	jquery-1.12.4.min.js Show response code.jquery.com/	95 KB 33 KB	115ms 37ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.12.4.min.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 6280652 x-cache HIT, HIT content-length 33738 x-served-by cache-lga21956-LGA, cache-cph2320022-CPH last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1721290834.694574,VS0,VE0 etag W/"28feccc0-17b8b" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 29, 27867
GET H3	200	jquery-migrate.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.4.1/	13 KB 5 KB	105ms 58ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.4.1/jquery-migrate.min.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 148a74b0921ad78021d716e8032ede1cdaf7ed7279cefd7d2acbe906add12a68 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 264060 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 4374 last-modified Fri, 24 Feb 2023 02:37:49 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "63f822fd-1116" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Og8rCE%2F%2ByF%2BcGkZkubislQVn7BNHmjRY0fy6ik%2FyuOsoYU7NeSYI7RRWy8KhIzXn9mMvOAWjX9C2B702cRItaV4iMBDO7CV85G%2Frfd%2FLPcmnNhpaBVVSMFLIVFn3U6LrrbJWVWO"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8a510d9e699e65c1-FRA expires Tue, 08 Jul 2025 08:20:33 GMT
GET H3	200	jquery-ui.min.js Show response cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/	249 KB 56 KB	77ms 57ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/jquery-ui.min.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9528ca634fecad433d044ddd3e6f9ce1f068d5d932dafdbb19d8e6daea1968bd Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 499380 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 56990 last-modified Fri, 29 Jul 2022 20:40:53 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "62e445d5-de9e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9TFgmnZmyJWRsv5jkvzxQkbNqpOshL2fmNitjVKx4dZDBoxdwix7t9hw2BaxoWfNjqFt2%2F6ShDGPcid%2FQ0n3qLfctkCMPVnUsTTOHjb4zaIcPd1qoQTKBks%2Fi0hARusajIu8M6hy"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8a510d9e699b65c1-FRA expires Tue, 08 Jul 2025 08:20:33 GMT
GET H3	200	jquery.cookie.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/	1 KB 1 KB	76ms 58ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 642447 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 591 last-modified Mon, 04 May 2020 16:11:45 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec1-514" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4sKcRSZM7Ap4dDWPa3%2FKb1apgH%2BcbEsIzCCHT%2BE5uDJ60faXLoavecdPx2Rrwh5F2TtLv%2FM602hvUDK29iSp%2BbOadiuuCZHEct%2BqTdYAznwERJAyeJ8UrxnTqearXd%2Be4pjoxemb"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8a510d9e69a165c1-FRA expires Tue, 08 Jul 2025 08:20:33 GMT
GET H3	200	jquery.form.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery.form/4.3.0/	17 KB 6 KB	122ms 103ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery.form/4.3.0/jquery.form.min.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd329c644951f3c041200e8279e3c90063ac5b5c8861fe253fca48df7dd8b99c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 498711 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5719 last-modified Sun, 07 Jun 2020 05:05:25 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5edc7595-42c6" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mg7vIoAjNMOfgjKUVk%2F3mpvDExZHYFMyoF7OUjmZm2EX6yiTGWlZ0Gb7ypSuD0N7Pwes1m8hJdQvs7WjEcDheRegwdOUXNjv4fGd%2Bezc%2BnPeBGINi6wmbeWpCEleN%2BIlhXGBhxtt"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8a510d9e699865c1-FRA expires Tue, 08 Jul 2025 08:20:33 GMT
GET H2	200	utag.sync.js Show response tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/	23 KB 6 KB	223ms 92ms	Script application/javascript	2600:9000:235a:8a00:7:2bfb:7c00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.sync.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:235a:8a00:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash ea07860293f07c2308249b8655e8ef4d5c1569accaec066614e9e49190103cbb Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-amz-version-id ho1Qs_7AJ5mr5ny9KwcltzOLaxCY8Whp content-encoding br via 1.1 2ad26f5878b778b17955978bf962dc9a.cloudfront.net (CloudFront) date Thu, 18 Jul 2024 08:19:05 GMT last-modified Tue, 16 Jul 2024 17:03:36 GMT server AmazonS3 x-amz-cf-pop FRA60-P9 age 92 x-amz-server-side-encryption AES256 etag W/"2dcc7c313c7551888d9b80c8c5e4d90d" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript cache-control max-age=300 x-amz-cf-id NIqBM5wDx3_GHOr6J9D6XPwo4KELl42WFhWQoH51efgsKDiVG4h2ug==
GET H3	200	v2.js Show response js.hsforms.net/forms/	482 KB 156 KB	122ms 74ms	Script application/javascript	104.18.142.119 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsforms.net/forms/v2.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.142.119 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ee3184f88b136b6ad521ec8d57fcf138b0c78172ee82e5d8773998bebac6486d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers content-encoding gzip age 121 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.5387/bundles/project-v2.js&cfRay=8a510aa3da4f2c53-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"56164b8f5dbcf6e65e555e48d5d6176a" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.5387/bundles/project-v2.js date Thu, 18 Jul 2024 08:20:33 GMT x-amz-version-id mnlqbpb.vUvH_hPLxl7NeOxIrfIBia92 x-content-type-options nosniff cf-cache-status HIT via 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront) nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id fd10b392-b7f9-4bc9-b13b-32cc5c41863b x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id fd10b392-b7f9-4bc9-b13b-32cc5c41863b last-modified Thu, 06 Jun 2024 13:36:59 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0k3K7pADLG6%2BHwl0AUbz5lcwv8TIfrEyVxd1XRNpDBb2cCV4XH%2FiPqYi%2Bi3tLl94NQLfyrGx%2FWUlwIDrUqrgQtzf8JK3FF8OEG3qo762u6xSRTI6K3HvRq6RSpee7qad"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-65f7f7c749-fvpqg cf-ray 8a510d9e98639f40-FRA x-amz-cf-id ILORvgk8y8ct6j1mtNy5X98Z4W2GxGtdarQl001ZPhSFwxLQ1CG1tQ==
GET H2	200	js__W3yM6WBe6ndCsZPBg4n630CPZFPltBmeCyjdVT1DY70__bDRoZCuiGZ0Z97B2lHvbrvG8HsJo-CC3-a0Ia2Sx5bE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	11 KB 5 KB	119ms 111ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__W3yM6WBe6ndCsZPBg4n630CPZFPltBmeCyjdVT1DY70__bDRoZCuiGZ0Z97B2lHvbrvG8HsJo-CC3-a0Ia2Sx5bE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f443007354af04e5d9f0aea2ce21303442752753ce63ab035a6c76d4f06d5d52 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sat, 17 May 2025 05:22:12 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-8688d6cf87-vrdl9 content-length 4874 x-served-by cache-chi-kigq8000024-CHI, cache-cph2320041-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:59 GMT server nginx x-timer S1721290834.698261,VS0,VE4 etag W/"65e6b647-2a50" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 402786fd-1344-11ef-8bd4-c263bcbaff8d cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__ZyeOaiFuDejQQbhUV7yg7atYZnj4WLfH77o0scv4068__jeShjS1-sEwOx4dbB-NSBsCnxWfNslS1Nkgx4CZngGA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	13 KB 5 KB	110ms 102ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__ZyeOaiFuDejQQbhUV7yg7atYZnj4WLfH77o0scv4068__jeShjS1-sEwOx4dbB-NSBsCnxWfNslS1Nkgx4CZngGA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff79200e9d0486ad1207f01f3c5918eea0771ded9b1681694da8caaae4c74c1a Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 47, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-fddpv content-length 4854 x-served-by cache-chi-kigq8000072-CHI, cache-cph2320024-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:05:49 GMT server nginx x-timer S1721290834.698265,VS0,VE4 etag W/"65e6b63d-343a" vary Accept-Encoding content-type application/x-javascript x-styx-req-id d721c50f-f1d7-11ee-a6cf-faab7e7aaaa3 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:02 GMT
GET H2	200	js__2rjlAbBND-YDbAq2rT4GT0FCGSz_kyEdQdZyOStVQdU__SGggvtYH6KAFWT2NGquosWK1SoWokfbyhZ2MaWmzq9I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	547 B 603 B	110ms 103ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__2rjlAbBND-YDbAq2rT4GT0FCGSz_kyEdQdZyOStVQdU__SGggvtYH6KAFWT2NGquosWK1SoWokfbyhZ2MaWmzq9I__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 634b615987ef6bc5cf11ff7eb78673aebf61e436dc7a56de0f4b4aa543ccb577 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-srsz5 content-length 294 x-served-by cache-chi-klot8100132-CHI, cache-cph2320040-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:06:00 GMT server nginx x-timer S1721290834.698236,VS0,VE3 etag W/"65e6b648-223" vary Accept-Encoding content-type application/x-javascript x-styx-req-id e597477d-f1d7-11ee-83a9-32c190c1efda cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	js__5zhFBHWG8cFOCNCpDlj7pwNwFoSGFvQEfYJiiLp0EY8__TNItwctO0QcNBYn10Ft2xshT-_PqYf8Vv6JB7nZ2xKs__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	27 KB 8 KB	122ms 115ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__5zhFBHWG8cFOCNCpDlj7pwNwFoSGFvQEfYJiiLp0EY8__TNItwctO0QcNBYn10Ft2xshT-_PqYf8Vv6JB7nZ2xKs__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 033ea4cefced423a11d0cc62afb56c3b09c16913abe8a891fc578b2f2327a101 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sat, 05 Jul 2025 23:44:02 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175875 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-p5mqc content-length 7981 x-served-by cache-chi-kigq8000113-CHI, cache-cph2320048-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:55 GMT server nginx x-timer S1721290834.698224,VS0,VE5 etag W/"65e6b643-6d75" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 4af7c218-3a5f-11ef-94c8-ee9e1dde6fad cache-control max-age=31622400 accept-ranges bytes x-cache-hits 58, 9, 0
GET H2	200	js__MK7MzOuOm6Wn1gEArVsBZG7dh82EREyAMIm9mRlUqq8__dORmwcviulacbj4TEHhv8s4qzj-5oUCjfNEX8y-ZUFM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	22 KB 8 KB	120ms 113ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__MK7MzOuOm6Wn1gEArVsBZG7dh82EREyAMIm9mRlUqq8__dORmwcviulacbj4TEHhv8s4qzj-5oUCjfNEX8y-ZUFM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b2da29ed5ab13ba88c22a51b412428640f8b495c40e0225d712d16eb6ea8351e Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-ltjwf content-length 7765 x-served-by cache-chi-kigq8000098-CHI, cache-cph2320050-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Tue, 05 Mar 2024 06:06:01 GMT server nginx x-timer S1721290834.698210,VS0,VE4 etag W/"65e6b649-59a3" vary Accept-Encoding content-type application/x-javascript x-styx-req-id e59287d2-f1d7-11ee-a4f1-16a0ed7bd780 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	js__YT6D1B_BKxvm6JCH_t9sZNI5L6yITa_DlU5QcSlOkAU__OXobH7d1IP1o3WABlniIrU_-pcJacVSIPUv9bpD-6pQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	730 B 698 B	203ms 196ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__YT6D1B_BKxvm6JCH_t9sZNI5L6yITa_DlU5QcSlOkAU__OXobH7d1IP1o3WABlniIrU_-pcJacVSIPUv9bpD-6pQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 67138202cdb85739d98743e8226b60fbef18366ce3da88902bee16dacd0f0959 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-ph6zp content-length 381 x-served-by cache-chi-klot8100120-CHI, cache-cph2320039-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Tue, 05 Mar 2024 06:05:56 GMT server nginx x-timer S1721290834.702107,VS0,VE4 etag W/"65e6b644-2da" vary Accept-Encoding content-type application/x-javascript x-styx-req-id dd343a59-f1d7-11ee-89af-8edf77054182 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:12 GMT
GET H2	200	js__udVKtMVyYcbvVHDJ0nPML4nntXexNWL2oMqAdYSCgWM__DGF7DhDt4X72RMZfC0gLtM1DzR4cKNX-xUUTDHAODaQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	27 KB 10 KB	202ms 195ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__udVKtMVyYcbvVHDJ0nPML4nntXexNWL2oMqAdYSCgWM__DGF7DhDt4X72RMZfC0gLtM1DzR4cKNX-xUUTDHAODaQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c3af792cf17fc9da7b301e6ec8a24dcec9e7b4d3ef83622c2417329f658e8848 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Fri, 20 Jun 2025 16:17:46 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-6d4d877cc6-pgkh8 content-length 10066 x-served-by cache-chi-klot8100144-CHI, cache-cph2320026-CPH, cache-cph2320055-CPH last-modified Tue, 16 Apr 2024 13:54:18 GMT server nginx x-timer S1721290834.702089,VS0,VE4 etag W/"661e830a-6bc3" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 76e391db-2e57-11ef-adce-563e7797e590 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__chJL213YSkJch-IjytLyUqW7uGPnNqOcHGrVBTtmWRc__yn2ExM-BDbvoDYxfwBKmliyRc5GwBZkfllb5p--ixOE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	710 B 603 B	201ms 194ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__chJL213YSkJch-IjytLyUqW7uGPnNqOcHGrVBTtmWRc__yn2ExM-BDbvoDYxfwBKmliyRc5GwBZkfllb5p--ixOE__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 1f81387d932ab97c0ddff8edfc8e1ca4e37201b3cfb5d3911bc25a04e4087ae7 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-ph6zp content-length 306 x-served-by cache-chi-klot8100117-CHI, cache-cph2320056-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Tue, 05 Mar 2024 06:05:57 GMT server nginx x-timer S1721290834.701542,VS0,VE4 etag W/"65e6b645-2c6" vary Accept-Encoding content-type application/x-javascript x-styx-req-id dd2ddb29-f1d7-11ee-89af-8edf77054182 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:12 GMT
GET H2	200	js__vqZqTxUxqDoVSZOh60EjSleoZgwIzSlhamQKjS1JngU__S91yqV9ubUDMxzCK2GLBYdp1SFL3v48MFVTVZ3OSXjc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	798 B 797 B	203ms 196ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__vqZqTxUxqDoVSZOh60EjSleoZgwIzSlhamQKjS1JngU__S91yqV9ubUDMxzCK2GLBYdp1SFL3v48MFVTVZ3OSXjc__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0af941ad21ab4dc704f04bdf8d21825869cfe27eb61b3a37e295f70697c48c88 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Tue, 15 Jul 2025 05:16:16 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-778cbf697c-jgk2s content-length 428 x-served-by cache-chi-klot8100128-CHI, cache-cph2320039-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:06:02 GMT server nginx x-timer S1721290834.702572,VS0,VE4 etag W/"65e6b64a-31e" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 32226950-41a0-11ef-b5d5-c281824f74e2 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__A3z98XA9ArlnbHREYTcp6hgmi5Oz2wY1MqcLV75pq8Q__z2dbLyr7KaPpYQrjLtDeNRJ8Dddotk1Rd-5bC2zRyWo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	981 B 700 B	204ms 197ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__A3z98XA9ArlnbHREYTcp6hgmi5Oz2wY1MqcLV75pq8Q__z2dbLyr7KaPpYQrjLtDeNRJ8Dddotk1Rd-5bC2zRyWo__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 33df7d1430b49b83528e5df930e1da6d9bf492fb32b37ff2b9fd4d97834a0abd Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Mon, 12 May 2025 21:23:44 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175885 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-548957645b-ggnrv content-length 452 x-served-by cache-chi-klot8100097-CHI, cache-cph2320022-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:06:03 GMT server nginx x-timer S1721290834.702987,VS0,VE4 etag W/"65e6b64b-3d5" vary Accept-Encoding content-type application/x-javascript x-styx-req-id becdc4fc-0fdc-11ef-94bd-42e5d22ea1b9 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__BsJj-J0DDipBFUM6jWq6jBgbLlOJHFUDm1oaCirTN8s__3ytciCoM4ry2VdZVK_RnAXm_cZfbyZ0Tj9DCUWBKchw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	3 KB 2 KB	202ms 195ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__BsJj-J0DDipBFUM6jWq6jBgbLlOJHFUDm1oaCirTN8s__3ytciCoM4ry2VdZVK_RnAXm_cZfbyZ0Tj9DCUWBKchw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9e815610f978cad8bc6a72832b206c68e17bf6799cd0c937b2b3c30014243f73 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sun, 25 May 2025 07:15:48 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-6b7857bbbb-dfbjw content-length 1539 x-served-by cache-chi-klot8100066-CHI, cache-cph2320051-CPH, cache-cph2320055-CPH last-modified Tue, 19 Mar 2024 19:19:24 GMT server nginx x-timer S1721290834.701832,VS0,VE4 etag W/"65f9e53c-d5a" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 721db0cf-199d-11ef-a9e0-26ad238f469f cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__6FQAqJmB1yKdAJYwsXAk_hJnargJPvMPkf9xl2Aoo0E__LRcB_jb8iwtqJJbRU0etTiWNPUen87vOM9Rlp7OZGiI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	32 KB 14 KB	202ms 195ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__6FQAqJmB1yKdAJYwsXAk_hJnargJPvMPkf9xl2Aoo0E__LRcB_jb8iwtqJJbRU0etTiWNPUen87vOM9Rlp7OZGiI__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 6806cdcdd3c7f06950968eeebc5ed11dc261adde18cfefd541532fcf5e59ddff Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish x-pantheon-styx-hostname styx-fe1-b-69554747b9-h68w5 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU content-length 14177 x-served-by cache-chi-klot8100139-CHI, cache-cph2320055-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:06:03 GMT server nginx x-timer S1721290834.702748,VS0,VE3 etag W/"65e6b64b-81b7" vary Accept-Encoding content-type application/x-javascript x-styx-req-id e592268a-f1d7-11ee-9fa0-220fea7644ee cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	js__ZAA5lMeZXVSyc2jkDQc3qK2xTFroqEhe0Vhijw7cweY__awDE3dco34o6B5V5PT-wcPX9t75VGt6sjYxNLg-Ibew__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	6 KB 2 KB	207ms 200ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__ZAA5lMeZXVSyc2jkDQc3qK2xTFroqEhe0Vhijw7cweY__awDE3dco34o6B5V5PT-wcPX9t75VGt6sjYxNLg-Ibew__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c654220d555e70fb63334836085ed53e9a9d2982e79824664fba6d89e6dc490e Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Apr 2025 13:54:31 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-5b88b49ff7-c4v2w content-length 2104 x-served-by cache-chi-klot8100167-CHI, cache-cph2320047-CPH, cache-cph2320055-CPH last-modified Tue, 16 Apr 2024 13:54:19 GMT server nginx x-timer S1721290834.703240,VS0,VE4 etag W/"661e830b-183e" vary Accept-Encoding content-type application/x-javascript x-styx-req-id d99b81fb-fbf8-11ee-9c93-fae8d33dc845 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__VVbwMK3NMLbfvdLXAKRCOGZ9jqUjWHfUrPnJSWIlxkM__4Q4SNExXEfBJWUuxQzqhfoyno0u2-1mPRJyQnRmGPTQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	4 KB 2 KB	205ms 199ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__VVbwMK3NMLbfvdLXAKRCOGZ9jqUjWHfUrPnJSWIlxkM__4Q4SNExXEfBJWUuxQzqhfoyno0u2-1mPRJyQnRmGPTQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 61deedef5519831c5ba93b5ea4ccbe1d3a6a544c37709704271d05871caf1a02 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Wed, 21 May 2025 14:41:43 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175857 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-7d5d4db597-t449s content-length 1194 x-served-by cache-chi-kigq8000035-CHI, cache-cph2320032-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:06:26 GMT server nginx x-timer S1721290834.703617,VS0,VE3 etag W/"65e6b662-f33" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 13b2b807-16b7-11ef-ab5f-328758f3d7f2 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__ZW8o7ZZZ2WVdbdwiWGu52bSrkEFZV2xhp5aNyZR5USA__3tGfK_b3yc_EcnR78FUS1iLe24uT_kFOG0Zgxin4wcM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	4 KB 2 KB	205ms 199ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__ZW8o7ZZZ2WVdbdwiWGu52bSrkEFZV2xhp5aNyZR5USA__3tGfK_b3yc_EcnR78FUS1iLe24uT_kFOG0Zgxin4wcM__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 7a06dd94021db644db9732192dd8c6b062b80d3f99488e35ce495e82f0ccf961 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175857 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-srsz5 content-length 1541 x-served-by cache-chi-klot8100156-CHI, cache-cph2320052-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:06:04 GMT server nginx x-timer S1721290834.701619,VS0,VE6 etag W/"65e6b64c-f24" vary Accept-Encoding content-type application/x-javascript x-styx-req-id e594d3d7-f1d7-11ee-83a9-32c190c1efda cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	js__UCtXJrNvJbqWwTkauUyH6r0OmkrsjVeSImxlI3C6DJc__edC3yUE0SEy7im3t18SA-W_kx6imM-y8IQCkdmyHAt0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	4 KB 2 KB	200ms 194ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__UCtXJrNvJbqWwTkauUyH6r0OmkrsjVeSImxlI3C6DJc__edC3yUE0SEy7im3t18SA-W_kx6imM-y8IQCkdmyHAt0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash fd08b09bb992ad9d8eb1fa512716a782939ee1df7c7b10ebecef57bc7b023626 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 10, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175857 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-p72wq content-length 1260 x-served-by cache-chi-kigq8000118-CHI, cache-cph2320023-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Tue, 05 Mar 2024 06:06:05 GMT server nginx x-timer S1721290834.702111,VS0,VE3 etag W/"65e6b64d-ebd" vary Accept-Encoding content-type application/x-javascript x-styx-req-id ea32fd72-f1d7-11ee-b1db-162c3c5c54d7 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:34 GMT
GET H2	200	js__AV6-fb8rJ2QD61i8dwhUQihn7pc-Lp_VvhfmIjW8oHw__RUm4kKahOBCnrDpJWbA1cDqNhTD7qsBmlLW9ebsLhz0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	5 KB 2 KB	196ms 190ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__AV6-fb8rJ2QD61i8dwhUQihn7pc-Lp_VvhfmIjW8oHw__RUm4kKahOBCnrDpJWbA1cDqNhTD7qsBmlLW9ebsLhz0__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a167f660daaa2f0abba7204685eb46f7127b490d936f10747a2f8c5daba26b83 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sat, 21 Jun 2025 22:59:42 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-56d7969b4f-kpvrp content-length 1853 x-served-by cache-chi-klot8100113-CHI, cache-cph2320036-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:50 GMT server nginx x-timer S1721290834.701614,VS0,VE3 etag W/"65e6b63e-1377" vary Accept-Encoding content-type application/x-javascript x-styx-req-id c7e56e84-2f58-11ef-a52a-56441efc25bf cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__Z8_z4Ixa-D0iNdI4Vha8piNlJPIvuqBB03fpnqgg0ZU__7hSyf_bmxpB7an3khq1utmSHnVzI32jc5ywGqSrYb0g__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	3 KB 1 KB	203ms 197ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__Z8_z4Ixa-D0iNdI4Vha8piNlJPIvuqBB03fpnqgg0ZU__7hSyf_bmxpB7an3khq1utmSHnVzI32jc5ywGqSrYb0g__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ece4490c33a7069c08a0e696be3541870684db90df7dbb70205a99dc57973eac Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175857 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-fddpv content-length 1088 x-served-by cache-chi-kigq8000061-CHI, cache-cph2320027-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:06:18 GMT server nginx x-timer S1721290834.703114,VS0,VE4 etag W/"65e6b65a-bee" vary Accept-Encoding content-type application/x-javascript x-styx-req-id f017d2d1-f1d7-11ee-a6cf-faab7e7aaaa3 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:44 GMT
GET H2	200	js__3PyHVp_4SRq6pNQOBF08IE7KMR78aq2RPCDHv-23ni8__7F-DhWAuWWcJXOiKyc1JsZkkESiDxwbjA5pvRgf1qdA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	3 KB 2 KB	200ms 195ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__3PyHVp_4SRq6pNQOBF08IE7KMR78aq2RPCDHv-23ni8__7F-DhWAuWWcJXOiKyc1JsZkkESiDxwbjA5pvRgf1qdA__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2a4693f2cfab06c8f82a71e57d82363c57e3b93597ea2a9c08c2bb08f83839f0 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sat, 21 Jun 2025 02:28:28 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175857 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-6d4d877cc6-bqcts content-length 1351 x-served-by cache-chi-kigq8000071-CHI, cache-cph2320047-CPH, cache-cph2320055-CPH last-modified Tue, 16 Apr 2024 13:54:19 GMT server nginx x-timer S1721290834.702290,VS0,VE3 etag W/"661e830b-d77" vary Accept-Encoding content-type application/x-javascript x-styx-req-id c76b22be-2eac-11ef-bab3-626bd5dccaba cache-control max-age=31622400 accept-ranges bytes x-cache-hits 21, 28, 0
GET H2	200	js__g6mKbcakHxQkz4ZHYaxdO_xqONINvRMgsHh1zAK-fr0__ATHtEmHaeZ0jidpGU22EkhmPDBSgjD8z0bVDQMI-BIY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	2 KB 1 KB	199ms 193ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__g6mKbcakHxQkz4ZHYaxdO_xqONINvRMgsHh1zAK-fr0__ATHtEmHaeZ0jidpGU22EkhmPDBSgjD8z0bVDQMI-BIY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ac12f243172f3c8376a67f24942257093fd70d0c10212a58bf8df60f372be24e Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Sun, 29 Jun 2025 22:03:52 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-ct69k age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU content-length 762 x-served-by cache-chi-kigq8000175-CHI, cache-cph2320055-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:59 GMT server nginx x-timer S1721290834.701332,VS0,VE4 etag W/"65e6b647-76d" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 4e5db06a-359a-11ef-a5ff-065f8a95e18c cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__zwOQL0xjQu_jInUCc5HDDX7DuqNXThdgsBzScvBN6zY__YDKn5kOzd1mgJhYu7UkUXBFTO-WC5n-FhasqlgTZXKY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	10 KB 4 KB	189ms 183ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__zwOQL0xjQu_jInUCc5HDDX7DuqNXThdgsBzScvBN6zY__YDKn5kOzd1mgJhYu7UkUXBFTO-WC5n-FhasqlgTZXKY__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0eb42d32c51e79e9d48a5694328c0ce8889f58a2c25bf13f239a8d818226a96a Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Tue, 10 Jun 2025 05:52:35 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175857 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-59b5bdfd9-jkpwr content-length 3791 x-served-by cache-chi-kigq8000049-CHI, cache-cph2320051-CPH, cache-cph2320055-CPH last-modified Tue, 16 Apr 2024 13:54:33 GMT server nginx x-timer S1721290834.701335,VS0,VE3 etag W/"661e8319-262c" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 78cf0433-2624-11ef-9069-0ee4d9524d06 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__XtFha_knURVT5YLGKmVYz2S732sgaVuOjO801TC1X90__Iiz_LtHOgN-NEjf_Wqk78-4FPz8AQR7Ygonew_LemTU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	1017 B 801 B	188ms 183ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__XtFha_knURVT5YLGKmVYz2S732sgaVuOjO801TC1X90__Iiz_LtHOgN-NEjf_Wqk78-4FPz8AQR7Ygonew_LemTU__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2db23bd96dca0757b0f0d309acb62fe766c08348c86c195ed79658f7f7b456c3 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Wed, 14 May 2025 18:10:45 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-668bdc8fc7-dbxfj content-length 566 x-served-by cache-chi-kigq8000115-CHI, cache-cph2320059-CPH, cache-cph2320055-CPH last-modified Tue, 05 Mar 2024 06:05:51 GMT server nginx x-timer S1721290834.701055,VS0,VE3 etag W/"65e6b63f-3f9" vary Accept-Encoding content-type application/x-javascript x-styx-req-id 1e571dcb-1154-11ef-8cb9-329c1be5de60 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 0, 9, 0
GET H2	200	js__ANAjsl90aU8V_JJuHtJWcRsK1EGBFuMwHq693fURsXU__F1FPONSTf0yEH0Y9VHtO8-UlYOiMFKhCksEr6rzCrMg__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	2 KB 920 B	189ms 184ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__ANAjsl90aU8V_JJuHtJWcRsK1EGBFuMwHq693fURsXU__F1FPONSTf0yEH0Y9VHtO8-UlYOiMFKhCksEr6rzCrMg__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3180fea88eaa47e87effdffd92cc7f52249a701909b6b617b2d0c55b7a0e7c98 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-69554747b9-h68w5 content-length 629 x-served-by cache-chi-kigq8000137-CHI, cache-cph2320039-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05 last-modified Tue, 05 Mar 2024 06:06:01 GMT server nginx x-timer S1721290834.701042,VS0,VE3 etag W/"65e6b649-61e" vary Accept-Encoding content-type application/x-javascript x-styx-req-id ddd9505b-f1d7-11ee-9fa0-220fea7644ee cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:13 GMT
GET H2	200	js__1DBjoSMQlQ4ixA_cuaJfS5Px949O7h4aDn8Z9xtRW7Q__AT6c7sCefn259J383Kk5L3xgymjOI5hghQofGOoaazQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	21 KB 7 KB	199ms 195ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__1DBjoSMQlQ4ixA_cuaJfS5Px949O7h4aDn8Z9xtRW7Q__AT6c7sCefn259J383Kk5L3xgymjOI5hghQofGOoaazQ__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 7dfeb329f73421a0c80e8a067d3e1d67c916c84746f94cb9826c06bc58516d1f Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Fri, 27 Jun 2025 13:26:32 GMT date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-ct69k content-length 6820 x-served-by cache-chi-klot8100110-CHI, cache-cph2320047-CPH, cache-cph2320055-CPH last-modified Wed, 26 Jun 2024 13:26:03 GMT server nginx x-timer S1721290834.701022,VS0,VE4 etag W/"667c16eb-55f3" vary Accept-Encoding content-type application/x-javascript x-styx-req-id b45e7b01-33bf-11ef-a5ff-065f8a95e18c cache-control max-age=31622400 accept-ranges bytes x-cache-hits 53, 9, 0
GET H2	200	js__QEUI7Yv_wakfcc6JBvi15ovY1U6doRpL4VmJGHt4na4__bunscNd0XY0JtFyEPHN8vrG4QmOdFsldeaRN0v3VA9M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Show response www.forcepoint.com/sites/default/files/advagg_js/	79 KB 27 KB	190ms 185ms	Script application/x-javascript	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/default/files/advagg_js/js__QEUI7Yv_wakfcc6JBvi15ovY1U6doRpL4VmJGHt4na4__bunscNd0XY0JtFyEPHN8vrG4QmOdFsldeaRN0v3VA9M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2da781a6191588a46eeb8e47e2d5c4fd2d49a2eceeb1e6e061dbac289e63dc7c Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175857 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-64b977755d-p72wq content-length 26917 x-served-by cache-chi-klot8100116-CHI, cache-cph2320053-CPH, cache-cph2320055-CPH backend-ip-port 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_a_sharedvpc_dmz_01 last-modified Mon, 18 Mar 2024 14:45:01 GMT server nginx x-timer S1721290834.701020,VS0,VE4 etag W/"65f8536d-13c91" vary Accept-Encoding content-type application/x-javascript x-styx-req-id e5945f6d-f1d7-11ee-b1db-162c3c5c54d7 cache-control max-age=31622400 accept-ranges bytes expires Fri, 04 Apr 2025 16:33:26 GMT
GET H2	200	/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.forcepoint.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.forcepoint.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=www.forcepoint.com&pId=3186238014174036796	4 B 280 B	332ms 226ms	Image application/json	2600:9000:206f:e000:5:7a81:86c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://attr.ml-api.io/?domain=www.forcepoint.com&pId=3186238014174036796 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Server 2600:9000:206f:e000:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:34 GMT via 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C1 x-cache Miss from cloudfront content-type application/json alt-svc h3=":443"; ma=86400 content-length 4 apigw-requestid bGV87j3gIAMEayg= x-amz-cf-id C-Yj4w7cdQ124HjXR1-_y-jZkO7ZLLdtV1CxsWxq_Tfjw_pe8_YTqg== Redirect headers pragma no-cache date Thu, 18 Jul 2024 08:20:34 GMT an-x-request-uuid 3614c332-77b0-4372-b767-2586a098fc79 server nginx/1.23.4 accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" content-type text/html; charset=utf-8 access-control-allow-origin * cache-control no-store, no-cache, private access-control-allow-credentials true location https://attr.ml-api.io/?domain=www.forcepoint.com&pId=3186238014174036796 x-proxy-origin 80.255.7.119; 80.255.7.119; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com content-length 0 x-xss-protection 0 expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	utag.js Show response tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/	434 KB 111 KB	210ms 94ms	Script application/javascript	2600:9000:235a:8a00:7:2bfb:7c00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:235a:8a00:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e6bb0467284ad6bf4b716def881b4ecb16751807121ba3e2fcca55a33c850dc0 Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-amz-version-id 2i6PDnq9Dj4ToerNLa_U9W6mjHKEMpq_ content-encoding br via 1.1 2ad26f5878b778b17955978bf962dc9a.cloudfront.net (CloudFront) date Thu, 18 Jul 2024 08:18:03 GMT last-modified Tue, 16 Jul 2024 17:03:36 GMT server AmazonS3 x-amz-cf-pop FRA60-P9 age 151 x-amz-server-side-encryption AES256 etag W/"0d6f6bedfcf3c993f2460235311eff1a" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript cache-control max-age=300 x-amz-cf-id fCpenIF0IKPlUmOTDV1cPu9-m9rzisjeurcUyFR0tfbPlDi0drGsmg==
GET H2	200	forcepoint.svg www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/	2 KB 0	3ms 3ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/forcepoint.svg Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c7397ae13ad9d12bf4ce9100756dd8703b515ac4381bdd33638e22c787c0fb39 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 21, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-jjllv age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU content-length 783 x-served-by cache-chi-klot8100172-CHI, cache-cph2320046-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:36:00 GMT server nginx x-timer S1721290833.469427,VS0,VE4 etag W/"66958830-6ad" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id 1708bde2-4345-11ef-bfff-92b70a8cdf9e cache-control max-age=31622400 accept-ranges bytes expires Thu, 17 Jul 2025 07:29:09 GMT
GET H2	200	placeholder_image.png www.forcepoint.com/sites/all/themes/custom/fp/assets/img/	34 B 0	103ms 103ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/placeholder_image.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 735b78ae1f09b1d02ee92b5ad319a189d50d10ecbec4ddd12201885dde3f4945 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 191, 2 date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-p5mqc fastly-io-served-by vpop-etou8240196 age 714594 http_x_geo_region DE-BY x-cache MISS, HIT, HIT, HIT fastly-io-info ifsz=1272 idim=20x20 ifmt=png ofsz=34 odim=20x20 ofmt=webp http_x_geo_continent EU fastly-stats io=1 content-length 34 x-served-by cache-chi-kigq8000157-CHI, cache-ams21022-AMS, cache-ams21022-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.698349,VS0,VE1 etag "1Cw1g26qcqy/qXiETpkqMbr8ayhbr57dIxJ0jC+RrrE" vary Accept content-type image/webp x-styx-req-id ced02715-3e5e-11ef-9a42-ee9e1dde6fad cache-control max-age=31622400 accept-ranges bytes expires Fri, 11 Jul 2025 01:50:38 GMT
GET DATA	200 OK	truncated /	166 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4e2a8b16a227605843bcf04d32557fa5f790d17d5fae10db399f3ad6b75cae70 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	450 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 77bfa66bf799ef1d5be3e464795aaca2f9a0587c1616b9671f7383623474f455 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	141 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1a5c0fb755eabd84fa9ee65115561abfc934cb67631d8392acc299bed349942d Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	187 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c181c648e71e1f94dc9f3aa0aced539df9790bc1aa92494d7fe7b17c274767bf Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	660 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8892ffd9b6812e96fca28cf2b24a4a1e25711631d73141353f1ec57fcaf523b8 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	372 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c6a4f005d0158d27d475991d4606ec4141f42917cc68835019d819c583957710 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	372 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c0c810909068da447ca522f9770490722119d254f18905ae37e5e4a45e2c346c Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	248 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash de0c91884c0f70a3c8ab477b2637d9c9417fc74eb663bbe6eace7836e8b38fc3 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H2	200	chevron-right-xxs.svg www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/	213 B 568 B	185ms 185ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/chevron-right-xxs.svg Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash eb06d9c1faf512de924b0840e5ff2cea13ea5154e84b9a2edb23c3ee94602bd7 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 19, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175883 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-778cbf697c-x5pqn content-length 174 x-served-by cache-chi-kigq8000176-CHI, cache-cph2320050-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:36:00 GMT server nginx x-timer S1721290834.701606,VS0,VE3 etag W/"66958830-d5" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id 17e28133-4345-11ef-9849-f21714ecd673 cache-control max-age=31622400 accept-ranges bytes expires Thu, 17 Jul 2025 07:29:10 GMT
GET DATA	200 OK	truncated /	636 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e25fa89bb49f7875384fe86ddb39c8c0a966f7aff529e4aa1e761efe8909fdad Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	636 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8048b6a47a7795c53151c7d28f992a190da59cfa9416a171a03652359a964f2a Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	636 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 68cb94151d86903ee4b3a5088e233b408a81a7faf9bb97d1172d8e3e6a83f868 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	banner-woman.jpg www.forcepoint.com/sites/default/files/	12 KB 13 KB	94ms 94ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/default/files/banner-woman.jpg Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b9b8fe9d0d7983bd3dc05016caf09d5028c4525e9beba05ecf0ed85bd0f3f86a Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 289, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240195 age 1908741 http_x_geo_region DE-BY x-cache HIT, HIT, HIT, HIT fastly-io-info ifsz=139269 idim=591x426 ifmt=jpeg ofsz=12712 odim=591x426 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-fff8fdb6d-mgt8t content-length 12712 x-served-by cache-chi-klot8100073-CHI, cache-ams2100085-AMS, cache-ams2100120-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.700958,VS0,VE0 etag "N0lQYBtHe5ciagpRVpui8m2mvIrccgSXz/6JZdtfgoA" vary Accept content-type image/webp x-styx-req-id 5fd10c48-1254-11ef-8773-22ec67fc409e cache-control max-age=31622400 accept-ranges bytes expires Fri, 16 May 2025 00:45:06 GMT
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ff35e1bb0b3e1cb03aa7eab3fb0f74381ec3fd6fcff85d8c4f6be72abae116a0 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e1652e3fbc6cef41f94897b295b6b1f57fa4901a3727e4c9ecb2911614531d0f Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET DATA	200 OK	truncated /	750 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 26e256bfa2011f9fbbe0e81f2515c98b94b7ee7696a82f380cb7e7c8361e04a4 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET H2	200	ajax-loader.gif www.forcepoint.com/sites/all/themes/custom/fp/assets/img/	365 B 824 B	70ms 69ms	Image image/gif	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/ajax-loader.gif Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 195211df418c32079abb41bb0ebd2ea3aace287509a9c49702d80f1350313527 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 230, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240193 age 1407346 http_x_geo_region DE-BY x-cache HIT, HIT, HIT, HIT fastly-io-info ifsz=404 idim=43x11 ifmt=gif ofsz=365 odim=43x11 ofmt=gif ofrm=4 http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-cr9cd content-length 365 x-served-by cache-chi-klot8100112-CHI, cache-ams21053-AMS, cache-ams21053-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.700910,VS0,VE0 etag "c9vdSz1SobFgJvEEIebuVOe3obQGnXd87HeEFJfv0io" vary Accept content-type image/gif x-styx-req-id de7675fd-3811-11ef-a4c5-563f282b1988 cache-control max-age=31622400 accept-ranges bytes expires Thu, 03 Jul 2025 01:24:46 GMT
GET H2	200	bg-blog-podcast-final-plea.png www.forcepoint.com/sites/all/themes/custom/fp/assets/img/backgrounds/	136 KB 137 KB	92ms 92ms	Image image/webp	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/backgrounds/bg-blog-podcast-final-plea.png Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash defd01b0db74c62e4efe18ef38e5ec968f2b8c2cf51ab6b14f12e1ad250eec84 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 59, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:33 GMT fastly-io-served-by vpop-etou8240196 age 1112422 http_x_geo_region DE-BY x-cache HIT, MISS, HIT, HIT fastly-io-info ifsz=236236 idim=580x458 ifmt=png ofsz=139710 odim=580x458 ofmt=webp http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-a-5d77cc44f5-w9nrv content-length 139710 x-served-by cache-chi-kigq8000133-CHI, cache-ams21029-AMS, cache-ams21029-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.700874,VS0,VE0 etag "J4HM7COV6lmZQG/n7TaO0MtxZmafgyzKI2fNbOojs8E" vary Accept content-type image/webp x-styx-req-id 8b35096c-3ac0-11ef-b993-de70e4427182 cache-control max-age=31622400 accept-ranges bytes expires Sun, 06 Jul 2025 11:20:11 GMT
GET H2	200	f-white.svg www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/	257 B 581 B	173ms 173ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/logos/f-white.svg Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2a7b733b2f19d538893df08b2c194aef1201dbad6ee2ddafc5bcd34cbb482d6b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 35, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175883 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-d8mdp content-length 187 x-served-by cache-chi-klot8100146-CHI, cache-cph2320047-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:36:00 GMT server nginx x-timer S1721290834.700844,VS0,VE4 etag W/"66958830-101" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id 17e26d46-4345-11ef-879d-66813a86faf3 cache-control max-age=31622400 accept-ranges bytes expires Thu, 17 Jul 2025 07:29:10 GMT
GET DATA	200 OK	truncated /	442 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6116382548abaad3d6133a60e2dc187d88dfa1ed07d981311c0bbcfaee05cd49 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	icon-anchor-arrow-teal.svg www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/	655 B 607 B	178ms 178ms	Image image/svg+xml	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/static-icons/icon-anchor-arrow-teal.svg Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 29aebe811bb2f84bd90cfdee7ffc4c4af62bb5d871fd683f8a85bf0852ce9163 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 35, 9, 0 date Thu, 18 Jul 2024 08:20:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175883 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU x-pantheon-styx-hostname styx-fe1-b-778cbf697c-8gq4f content-length 400 x-served-by cache-chi-kigq8000077-CHI, cache-cph2320021-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:36:00 GMT server nginx x-timer S1721290834.700836,VS0,VE4 etag W/"66958830-28f" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-styx-req-id 17e25f95-4345-11ef-92c5-1af899943841 cache-control max-age=31622400 accept-ranges bytes expires Thu, 17 Jul 2025 07:29:10 GMT
GET DATA	200 OK	truncated /	383 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b5c2800c52737f3425d0e434c93f9412da5e0491282c8d3d53b4d707202b8cef Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	558 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f4cbc6a70cd3d48475ddbb975d3831d02e4158a76fcdb997891baa497ea31241 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	356 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6676353d7029b44112419ac26efd665e84021eb418ccf05a1e1f04d0ba46bd53 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	431 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash af60288a11ae9864cdd707a9c6e13463359d5ffb6755bf9035a878f18b8758f9 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	688 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0ec291adef932c1e26510f560daef99d2d26b96331cbfd2f29fe234eaf2dddae Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H2	200	Hoves_DemiBold.woff www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/	18 KB 0	0ms 0ms	Font font/woff	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/fonts/hoves-optimized/Hoves_DemiBold.woff Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c6225223a7f689e02ca4f2144e864ad46dd63e29553cf3d4df572e7195303be0 Request headers Referer https://www.forcepoint.com/sites/default/files/advagg_css/css__5_J1g-IzxVB2kAmpTJT-GhoR88E1teSy_bXl1NQCXaI__yLUlsZO8Aw1QbDVmt9Emb7WQDVsiqE8WSyAbbDd2S8M__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.css Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Thu, 17 Jul 2025 07:29:08 GMT date Thu, 18 Jul 2024 08:20:33 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish x-pantheon-styx-hostname styx-fe1-a-67db8dc7b8-zjqjf age 175884 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU content-length 18868 x-served-by cache-chi-kigq8000080-CHI, cache-cph2320026-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290833.432866,VS0,VE3 etag "6695882f-49b4" content-type font/woff access-control-allow-origin * x-styx-req-id 16ff3adc-4345-11ef-a32f-9265e67163a1 cache-control max-age=31622400 accept-ranges bytes x-cache-hits 20, 9, 0
GET H3	200	json Show response forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/	47 KB 7 KB	253ms 194ms	XHR application/json	104.18.80.204 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/json?hs_static_app=forms-embed&hs_static_app_version=1.5387&X-HubSpot-Static-App-Info=forms-embed-1.5387 Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/v2.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c32f566ca6ee6abf3a517629ab9630e6e855cac21887223630eb26a49d25f421 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-origin-hublet na1 date Thu, 18 Jul 2024 08:20:34 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id d3dc5ab0-9895-4d65-b32f-97571dd0e24b x-envoy-upstream-service-time 14 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d3dc5ab0-9895-4d65-b32f-97571dd0e24b server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.forcepoint.com x-evy-trace-virtual-host all access-control-expose-headers X-Origin-Hublet access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store x-robots-tag none access-control-allow-headers * cf-ray 8a510da14f5fc056-WAW x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-jxrsm
GET H3	200	json Show response forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/	47 KB 7 KB	443ms 191ms	XHR application/json	104.18.80.204 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hsforms.com/embed/v3/form/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e/json?hs_static_app=forms-embed&hs_static_app_version=1.5387&X-HubSpot-Static-App-Info=forms-embed-1.5387 Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/v2.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f2bf80609297038d477ed6582c15c50a67f70101bff60e1f4b1b384c730d5e8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-origin-hublet na1 date Thu, 18 Jul 2024 08:20:34 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 2fcefaa1-f7d2-4576-84c8-3acc9e204c34 x-envoy-upstream-service-time 13 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 2fcefaa1-f7d2-4576-84c8-3acc9e204c34 server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.forcepoint.com x-evy-trace-virtual-host all access-control-expose-headers X-Origin-Hublet access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store x-robots-tag none access-control-allow-headers * cf-ray 8a510da27903c056-WAW x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-gqvlc
GET H2	200	loading.gif www.forcepoint.com/sites/all/themes/custom/fp/assets/img/	76 KB 77 KB	38ms 38ms	Image image/gif	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/img/loading.gif Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3f3a06c93db350a7a9d3616a3dbbd6c252e702ade48978256c8a125fc2981d2d Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 0, 0, 151, 2 strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish date Thu, 18 Jul 2024 08:20:34 GMT fastly-io-served-by vpop-etou8240193 age 706469 http_x_geo_region DE-BY x-cache MISS, HIT, HIT, HIT fastly-io-info ifsz=80522 idim=200x200 ifmt=gif ofsz=78253 odim=200x200 ofmt=gif ofrm=30 http_x_geo_continent EU fastly-stats io=1 x-pantheon-styx-hostname styx-fe1-b-5d587d78fd-p5mqc content-length 78253 x-served-by cache-chi-kigq8000130-CHI, cache-ams21030-AMS, cache-ams21030-AMS, cache-cph2320055-CPH server nginx x-timer S1721290834.066820,VS0,VE0 etag "Nxhc6+NYNokf+oi4tit7qUckgh54LwQ6JJFLiU/ddPg" vary Accept content-type image/gif x-styx-req-id ba834371-3e71-11ef-9a42-ee9e1dde6fad cache-control max-age=31622400 accept-ranges bytes expires Fri, 11 Jul 2025 04:06:05 GMT
GET H2	200	utag.v.js Show response tags.tiqcdn.com/utag/tiqapp/	2 B 432 B	44ms 44ms	Script application/javascript	2600:9000:235a:8a00:7:2bfb:7c00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=websense/forcepoint-2018/202407161702&cb=1721290834055 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/websense/forcepoint-2018/prod/utag.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:235a:8a00:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-amz-version-id 2XUX04X5QEw0.xFya64khU._sHTRl_Pz date Thu, 18 Jul 2024 08:15:52 GMT via 1.1 2ad26f5878b778b17955978bf962dc9a.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P9 age 283 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 2 last-modified Sat, 11 Mar 2023 06:57:46 GMT server AmazonS3 etag "7bc0ee636b3b83484fc3b9348863bd22" vary Accept-Encoding content-type application/javascript cache-control max-age=300 accept-ranges bytes x-amz-cf-id l8LyfS3MO5twoat9N5n2dmE3kccOoAWoSRWZmcjLVSOOMRapbHYlUQ==
GET H3	200	counters.gif forms-na1.hsforms.com/embed/v3/	35 B 850 B	235ms 178ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id ebde27d1-f433-4d44-b4fc-4330f8965ea9 x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ebde27d1-f433-4d44-b4fc-4330f8965ea9 server cloudflare vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-fr5m6 access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 8a510da2fb17c40d-WAW
GET DATA	200 OK	truncated /	133 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a4cbaa695a841f5471911a40cc4c2140d68b95d9fcaabb3b60e97db200c15b8d Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	/ Show response geolocation-db.com/json/	144 B 256 B	604ms 512ms	XHR text/html	159.89.102.253 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://geolocation-db.com/json/ Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.12.4.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 159.89.102.253 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 80748b3fadcb85dc598f3d4e3e955c2c7aa6d5cc140f40270ab10cf8c3f75763 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers access-control-allow-origin * date Thu, 18 Jul 2024 08:20:34 GMT content-encoding gzip server nginx/1.14.0 (Ubuntu) content-type text/html; charset=UTF-8
GET H3	200	counters.gif forms-na1.hsforms.com/embed/v3/	35 B 885 B	195ms 177ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id d78e60d4-167e-4d2b-b84e-c71341bcdf87 x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d78e60d4-167e-4d2b-b84e-c71341bcdf87 server cloudflare vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-fr5m6 access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 8a510da2fb18c40d-WAW
GET H2	200	/ Show response geolocation-db.com/json/	144 B 255 B	1170ms 727ms	XHR text/html	159.89.102.253 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://geolocation-db.com/json/ Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.12.4.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 159.89.102.253 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 80748b3fadcb85dc598f3d4e3e955c2c7aa6d5cc140f40270ab10cf8c3f75763 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers access-control-allow-origin * date Thu, 18 Jul 2024 08:20:35 GMT content-encoding gzip server nginx/1.14.0 (Ubuntu) content-type text/html; charset=UTF-8
GET H2	200	nr-rum-1.262.0.min.js Show response js-agent.newrelic.com/	49 KB 16 KB	115ms 39ms	Script application/javascript	2602:816:5001::39 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-rum-1.262.0.min.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2602:816:5001::39 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash a557b02ea64886c022f719706e39e65ad6ba8accd1ab25498e9dd18e6da880d7 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/ Origin https://www.forcepoint.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-amz-version-id r7yL2WJdLoR2RnA7cy4KmyFp0CcyXjOe content-encoding br via 1.1 varnish date Thu, 18 Jul 2024 08:20:34 GMT strict-transport-security max-age=300 x-amz-request-id CP4AVRJ9VNRYG8BY x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 15610 x-amz-id-2 WJ8Fzupb/4Cq59edY8SHcYL4mb/GyeBKC2yh9kPyoO9RicWSyQLsCbFFMKQ48Qn6ksziBtJZUDA= x-served-by cache-cph2320021-CPH last-modified Wed, 10 Jul 2024 15:59:13 GMT server AmazonS3 etag "8725f7bd03f3c4df3f40d580cf1e5f6c" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 accept-ranges bytes x-cache-hits 85219
GET H2	200	latest.js Show response scripts.simpleanalyticscdn.com/	7 KB 5 KB	125ms 40ms	Script application/javascript	2400:52e0:1e00::1080:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://scripts.simpleanalyticscdn.com/latest.js Requested by Host: www.forcepoint.com URL: https://www.forcepoint.com/sites/default/files/advagg_js/js__BsJj-J0DDipBFUM6jWq6jBgbLlOJHFUDm1oaCirTN8s__3ytciCoM4ry2VdZVK_RnAXm_cZfbyZ0Tj9DCUWBKchw__qaStjG1sZu8P344AWI6vFGGyB8OkDEJ3a-IBx5FlKT0.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash a965bdafdcbdf6a1bc0a04fb81ee6d5fb86e1fde7a2da4e8998ab3bcf467bdb4 Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 08:20:34 GMT content-encoding br cdn-edgestorageid 1080 cdn-storageserver DE-680 cdn-cachedat 04/30/2024 19:00:38 cdn-pullzone 103822 last-modified Mon, 10 Jul 2023 03:50:47 GMT server BunnyCDN-DE1-1080 cdn-fileserver 635 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"64ab8017-1d5b" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid 621ef7c8-45de-46e4-8237-2eca0c3a2d75 access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=604800 simple-analytics true cdn-requestid 45335e984979fdedee33c8f3f38148fb access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	favicon.ico www.forcepoint.com/sites/all/themes/custom/fp/assets/icons/favicon/	15 KB 933 B	42ms 42ms	Other image/x-icon	2a04:4e42:400::740 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.forcepoint.com/sites/all/themes/custom/fp/assets/icons/favicon/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:400::740 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 59a410a623d86c98b190b07e27d0cf4e36455f184fc85cc1a4021aac1bc8a860 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-pantheon-styx-hostname styx-fe1-b-778cbf697c-t7qk6 date Thu, 18 Jul 2024 08:20:34 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish, 1.1 varnish strict-transport-security max-age=300 age 175874 http_x_geo_region DE-BY x-cache HIT, HIT, MISS http_x_geo_continent EU expires Thu, 17 Jul 2025 07:29:20 GMT content-length 606 x-served-by cache-chi-klot8100165-CHI, cache-cph2320043-CPH, cache-cph2320055-CPH last-modified Mon, 15 Jul 2024 20:35:59 GMT server nginx x-timer S1721290835.631275,VS0,VE5 etag "6695882f-3aee" vary Accept-Encoding content-type image/x-icon x-styx-req-id 1e260433-4345-11ef-99b2-1aa621e8227a cache-control max-age=31622400 accept-ranges bytes x-cache-hits 15, 9, 0
POST H/1.1	200 OK	NRJS-922263b7f65c352c48b Show response bam.nr-data.net/1/	150 B 701 B	299ms 210ms	XHR text/plain	162.247.241.14 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam.nr-data.net/1/NRJS-922263b7f65c352c48b?a=477262540&v=1.262.0&to=YFEDbUMFXBBXB0RbXlkbNEtYSx0KWABVSh9HXBE%3D&rst=1481&ck=0&s=10697d5597360982&ref=https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses&ptid=c3206b41ba571b62&ap=1051&be=125&fe=1229&dc=673&at=TBYAGwsfTx4%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1721290833259,%22n%22:0,%22f%22:0,%22dn%22:6,%22dne%22:6,%22c%22:6,%22s%22:44,%22ce%22:84,%22rq%22:84,%22rp%22:125,%22rpe%22:169,%22di%22:761,%22ds%22:769,%22de%22:798,%22dc%22:1353,%22l%22:1353,%22le%22:1354%7D,%22navigation%22:%7B%7D%7D&fp=507&fcp=507 Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-rum-1.262.0.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash 2d178ee57c5d2a506b3799b50fea41d93ed1b786b8249434071bd048f2f376ac Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 content-type text/plain Response headers Date Thu, 18 Jul 2024 08:20:35 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Transfer-Encoding chunked access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/plain Access-Control-Allow-Origin https://www.forcepoint.com access-control-expose-headers Date Vary Accept-Encoding access-control-allow-credentials true cross-origin-resource-policy cross-origin Connection keep-alive CF-Ray 8a510da5c93644f2-TXL timing-allow-origin https://www.forcepoint.com
GET H/1.1	202 Accepted	simple.gif queue.simpleanalyticscdn.com/	43 B 410 B	141ms 43ms	Image image/gif	212.8.253.238 WORLDSTREAM
General Check archive.org Show headers Download Go to Show image Full URL https://queue.simpleanalyticscdn.com/simple.gif?version=cdn_latest_11&hostname=www.forcepoint.com&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36&https=true&timezone=Europe%2FBerlin&page_id=aa6cffeb-6cfe-47b0-af42-044b14fe022d&session_id=a05f4512-cc13-4a20-8b57-105d2c378338&sri=false&mobile=false&brands=%5B%5D&os_name=&os_version=&path=%2Fblog%2Fx-labs%2Fshadowroot-ransomware-targeting-turkish-businesses&viewport_width=1600&viewport_height=1200&language=de-DE&screen_width=1600&screen_height=1200&unique=true&id=aa6cffeb-6cfe-47b0-af42-044b14fe022d&type=pageview&time=1721290834752 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 212.8.253.238 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL), Reverse DNS 212-8-253-238.hosted-by-worldstream.net Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Referer https://www.forcepoint.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Pragma no-cache Date Thu, 18 Jul 2024 08:20:34 GMT Simple-Analytics-Feedback Thanks for sending this page view! Simple-Analytics-Location not_set Content-Type image/gif Access-Control-Allow-Origin * Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Keep-Alive timeout=5 Content-Length 43 Expires 0