www.securonix.com Open in urlscan Pro
2606:4700:3108::ac42:2b19  Public Scan

21 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

• https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
• https://unpkg.com/web-vitals@3.5.2/dist/web-vitals.iife.js

Request Chain 70

• https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js HTTP 302
• https://s.adroll.com/j/pre/index.js

Request Chain 79

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D61924%26time%3D1714011130952%26li_adsId%3D124a6cd9-91ce-4e51-bb49-7cfd4349eeae%26url%3Dhttps%253A%252F%252Fwww.securonix.com%252Fblog%252Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKXFYxELz8iKQAAAY8TBk4XFAUpzA8tC2oP43X1zvpv5EvPtjBCjsaSPkPAZlgbnEDDCkKjNmhFyoq4XVPrL9koInWd1w

102 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/	173 KB 41 KB	58ms 29ms	Document text/html	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4772cc01e82eec30d4b81d78b0b0f5bc7ff0d7acf0a5c051983c7b0089b27766 Security Headers Name Value Strict-Transport-Security max-age=31622400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers age 25271 cache-control public, max-age=31536000 cf-apo-via tcache cf-cache-status HIT cf-edge-cache cache,platform=wordpress cf-ray 879ace7bf9361e6a-FRA content-encoding br content-type text/html; charset=UTF-8 date Thu, 25 Apr 2024 02:12:10 GMT last-modified Wed, 24 Apr 2024 17:34:59 GMT link <https://www.securonix.com/wp-json/>; rel="https://api.w.org/", <https://www.securonix.com/wp-json/wp/v2/blog/25160>; rel="alternate"; type="application/json", <https://www.securonix.com/?p=25160>; rel=shortlink nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TymQ3mJtf4DLMT5oVPC7W4ef8lwNeCiDvpz5BumE2Rq%2BIFutpk%2B1tU03jBainW%2FX4ybrosNeNHwOkw0%2FFVdXp6xZChu6RD%2BozrVDewHhfe2L6rB0h2MbuaNCm5OVjMSPTjDETc3jnTxvf97OHmIG"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31622400 vary Accept-Encoding, Cookie, Cookie via 1.1 varnish, 1.1 varnish x-cache MISS, MISS x-cache-hits 0, 0 x-content-type-options nosniff x-frame-options SAMEORIGIN x-pantheon-styx-hostname styx-fe2-b-586f6cc498-fkcsc x-served-by cache-chi-kigq8000149-CHI, cache-ams21048-AMS x-styx-req-id f8be2fdf-0260-11ef-a246-72a1ad106822 x-timer S1713980098.449121,VS0,VE1358 x-xss-protection 1; mode=block
GET H2	200	pjm0fus.css use.typekit.net/	28 KB 3 KB	193ms 165ms	Stylesheet text/css	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/pjm0fus.css Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 32526fdcae3037b6c2d64e0728c146d0c6ba44bb3b663af970f05feab4393b15 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Thu, 25 Apr 2024 02:12:10 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 2381
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	35ms 6ms	Script text/javascript	2a00:1450:4001:82a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 24 Apr 2024 22:14:30 GMT content-encoding gzip x-content-type-options nosniff age 14260 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 24 Apr 2025 22:14:30 GMT
GET H2	200	styles.css www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/	57 KB 7 KB	21ms 18ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.6 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash af770f5afec3e9f10196ea60476a44dde4d80010e680500685b578fee468c8c7 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 cf-polished origSize=59240 content-encoding br x-cache HIT, HIT x-cache-hits 0, 4 x-served-by cache-chi-kigq8000178-CHI, cache-ams21059-AMS cf-bgj minify last-modified Sat, 13 Apr 2024 22:49:35 GMT server cloudflare x-timer S1713821308.013081,VS0,VE2 etag W/"661b0bff-e768" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1oyJoOIBIr89gzKcMlWdYmaxjC4Q47EkZwWmH3WzoP3A2i%2BEkSwipfDZ7GBSIJC9xWc1w84x6mVI8G5kpP3lIbvJm596eyLJ0sbifBzQSKY5aA990D69gCknFXKbn%2B9It1AC5Rure%2BYTJ4v7GwjZ"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86eec177-fa6d-11ee-8289-566fcc2daecf cache-control max-age=31622400 cf-ray 879ace7c495d1e6a-FRA x-pantheon-styx-hostname styx-fe2-b-77f64f9968-d655f
GET H2	200	wpcdt-public.css www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/	680 B 806 B	25ms 22ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/wpcdt-public.css?ver=2.5 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 175eab7bef961e3d69c7c97f5371d532f30be4547670ba55578ed1af53d3114d Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 18390 cf-polished origSize=822 content-encoding br x-cache HIT, HIT x-cache-hits 0, 4 x-served-by cache-chi-kigq8000137-CHI, cache-ams21066-AMS cf-bgj minify last-modified Sat, 13 Apr 2024 23:49:16 GMT server cloudflare x-timer S1713821308.021353,VS0,VE3 etag W/"661b19fc-336" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XcVr%2FKfJ9u%2B2No678gCi2OTZ9uaSxtHezNjGYFL7WSnXppkb1%2BDaBtPobRStUaxm2Ql2gVzm87h3AfSa0qAfX4IFbtN7d8C4YDxrHAQ8KX4Qt2FmKqCyGSHDWJ2PJmaoXfzOjXSUVfQkqPsAyUz8"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86ef542f-fa6d-11ee-a486-7aaebfcc1a9f cache-control max-age=31622400 cf-ray 879ace7c49601e6a-FRA x-pantheon-styx-hostname styx-fe2-a-57d8d64c7d-96n5x
GET H2	200	jquery.powertip.min.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	2 KB 890 B	20ms 18ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/jquery.powertip.min.css?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-57d8d64c7d-d4c5l x-served-by cache-chi-kigq8000120-CHI, cache-ams21024-AMS last-modified Sat, 13 Apr 2024 07:30:43 GMT server cloudflare x-timer S1713821308.015238,VS0,VE2 etag W/"661a34a3-70d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YVwmgU03JjvbvMlhDM14PWXzHhJaAtlrWZOpN7wBuFwRZ13VYLD3Peiyyr4FlmRiar4HuqEnReVbHP7qDL3g43Yzl9eB7E1%2B%2BDUMhYuZzcuCMRJRP5BXZ9n9nPpCW8W0GMp0yLg9TMZ8Itj3rslk"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86eecdf9-fa6d-11ee-9baf-2ab61ac3db7f cache-control max-age=31622400 cf-ray 879ace7c49611e6a-FRA x-cache-hits 0, 4
GET H2	200	maps_points.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	5 KB 2 KB	22ms 19ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/maps_points.css?ver=1.2.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5e2d296664123aed1106464a611ef20234a6eed68d82ed5b1afd66660b185c59 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 cf-polished origSize=6896 content-encoding br x-cache HIT, HIT x-cache-hits 0, 4 x-served-by cache-chi-klot8100052-CHI, cache-ams21080-AMS cf-bgj minify last-modified Sat, 13 Apr 2024 21:41:40 GMT server cloudflare x-timer S1713821308.018971,VS0,VE2 etag W/"661afc14-1af0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=89bH3R%2F3sLmQfCV8eA8RGMK05Db3OknB92bju1WiPoPJPBoZHWJe7S2NUmQ70uLniWaroRz9rtoHbpBISIfKpeK%2FVoPt9bjwZhYUBxUlw926V6wtO5%2BFABmuoh7FmpxFR4bWGK0iZj8cL0g%2BFMwE"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86f7ab94-fa6d-11ee-8fec-daca86ef21ae cache-control max-age=31622400 cf-ray 879ace7c49621e6a-FRA x-pantheon-styx-hostname styx-fe2-b-77f64f9968-b8pvd
GET H2	200	style.min.css www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/	258 B 568 B	21ms 19ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b9257e3e9c959214ddfab833a69a021ae6557403efe76afcbee259621175274 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-7pk4l x-served-by cache-chi-klot8100055-CHI, cache-ams21043-AMS last-modified Sat, 13 Apr 2024 22:49:35 GMT server cloudflare x-timer S1713821308.022747,VS0,VE3 etag W/"661b0bff-102" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3f4KH4Ne0Lv1gaA4Pe7d%2Fumhh4xsl2eCvZ35stewMZ%2B0BH7of8tcO3m06Wx7XJHJ673ZUdm3mTsk5QM%2F4VO%2BfPJVNOOsw85GtCQCXWqqweDYeyEFzMFqwcRObdBg9i%2FyWx4fWjmUvOG9g%2FgJ%2FCau"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86f79474-fa6d-11ee-810e-3e9b3257ad3f cache-control max-age=31622400 cf-ray 879ace7c49651e6a-FRA x-cache-hits 0, 4
GET H2	200	style.css www.securonix.com/wp-content/themes/securonix/assets/css/	443 KB 70 KB	33ms 31ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1713887471 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6eb4cf02a13fd5ba1886458ccf1596b2fcf5c63a26c437b61e4ee58f5e3f7b4f Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 16:01:25 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42612 cf-polished origSize=457588 content-encoding br x-cache MISS, MISS x-cache-hits 0, 0 x-served-by cache-chi-klot8100174-CHI, cache-ams21040-AMS cf-bgj minify last-modified Tue, 23 Apr 2024 03:46:53 GMT server cloudflare x-timer S1713888086.890566,VS0,VE161 etag W/"66272f2d-6fb74" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2BFcfIFg3aCrGZr8cKuypnRvOm1mb4ciL9w1dmfeAvSLLT6sIvcat236oQdjIUv9k91UQdWr4EE2z%2Fzm%2BQmAywvaKPyz96GmN%2BVjGjr%2BHVbgMFDiz2zooVsUeDlKy5E0LKRQNCyG6A0cqgO29wJw"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id bcfbc16d-018a-11ef-967f-1e20ba6ca139 cache-control max-age=31622400 cf-ray 879ace7c49661e6a-FRA x-pantheon-styx-hostname styx-fe2-b-76f6c9d98-zb7md
GET H2	200	stylesheet.css www.securonix.com/wp-content/themes/securonix/assets/css/fonts/	2 KB 789 B	22ms 20ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/css/fonts/stylesheet.css?ver=1713887471 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fbb6162a3febf0d96b3372dd4f325d2ecd9b9c4e2c6d23e2c2b4eeeb3d7ccdb0 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 16:01:25 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 7679 cf-polished origSize=2058 content-encoding br x-cache MISS, MISS x-cache-hits 0, 0 x-served-by cache-chi-klot8100032-CHI, cache-ams21020-AMS cf-bgj minify last-modified Tue, 23 Apr 2024 03:32:49 GMT server cloudflare x-timer S1713888086.893209,VS0,VE126 etag W/"66272be1-80a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W%2BjYxDBc3vWqmMaJzHzql%2BI3AX10XwqntaW1SXmbOp2rjm1ZdBHD5%2F4cagvCaNRSka129cdFdD9AcvmFLMxvQeOa%2FQG3R7XJ8amOjybhZ7jDsT%2Bxh3%2BJh0QNk2AfnS3e89U%2FjHBMn1r2awIVvoMO"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id bcfc4fd3-018a-11ef-811f-e627ebaa874e cache-control max-age=31622400 cf-ray 879ace7c49671e6a-FRA x-pantheon-styx-hostname styx-fe2-a-7d9c76749d-7vdxr
GET H2	200	default.css www.securonix.com/wp-content/plugins/tablepress/css/build/	6 KB 3 KB	22ms 20ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress/css/build/default.css?ver=2.1.7 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9bc19ce27e7fe54728be0d4489cf683005fd6f522bbf6391a681d7d2d8d3f190 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 cf-polished origSize=6091 content-encoding br x-cache HIT, HIT x-cache-hits 0, 4 x-served-by cache-chi-klot8100062-CHI, cache-ams21055-AMS cf-bgj minify last-modified Sat, 13 Apr 2024 21:41:41 GMT server cloudflare x-timer S1713821308.022871,VS0,VE2 etag W/"661afc15-17cb" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OO%2F2FRqSBwF9Q37hsLcpLFkSqDUQz51Zepdw7CHIxMKJqIeKkTuqNFTOE2dFaf8iuWHOukfwI3gNRY%2BXSHfLOFDJOhWmQXsu23ybLXJkScyZBR3p5WeuiEOq1fad5oQCPh4XIfG5zQTGkj6uaYTE"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86f70640-fa6d-11ee-94a7-1a3b08b151cb cache-control max-age=31622400 cf-ray 879ace7c49681e6a-FRA x-pantheon-styx-hostname styx-fe2-b-77f64f9968-bzdln
GET H2	200	tablepress-responsive.min.css www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/	9 KB 2 KB	23ms 21ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-rm6p6 x-served-by cache-chi-klot8100134-CHI, cache-ams21079-AMS last-modified Sat, 13 Apr 2024 23:49:17 GMT server cloudflare x-timer S1713821308.022871,VS0,VE2 etag W/"661b19fd-22aa" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kncxaJucW82POVxzp%2BAppku8LOBprZmAiPeu4bxdu%2Fy36bsGhgCkPGX5xbKNQouKpN4uQaEJCxnWlsYZTtzqlXkpAHzCwB1DyzPaXRS6FjWPCQovZnpD4j4mWB25m19AgaXL82HKAOn1ZEAdyaHW"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86f74c07-fa6d-11ee-93a3-66529c49ef00 cache-control max-age=31622400 cf-ray 879ace7c49691e6a-FRA x-cache-hits 0, 4
GET H2	200	addtoany.min.css www.securonix.com/wp-content/plugins/add-to-any/	2 KB 958 B	23ms 21ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-57d8d64c7d-vwdbt x-served-by cache-chi-klot8100052-CHI, cache-ams21054-AMS last-modified Sat, 13 Apr 2024 07:30:41 GMT server cloudflare x-timer S1713821308.024454,VS0,VE3 etag W/"661a34a1-644" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SGC%2BTkJEtN5WmJGAuTdua6sC8GTcoorTHVW3ShRFCkEDcFNZ9RxmUnoSs1JFuWdn4U5bY9X%2FMHwMXFnuFbiRrQhYMHbGKv5varmbMQR3Wje6A%2F0N7UO4Qom0wv5l0h806g9iLz3qAAquaVmZcY4r"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86f5e7ea-fa6d-11ee-b983-a608f412765a cache-control max-age=31622400 cf-ray 879ace7c496a1e6a-FRA x-cache-hits 0, 4
GET H2	200	ubermenu.min.css www.securonix.com/wp-content/plugins/ubermenu/pro/assets/css/	66 KB 10 KB	32ms 30ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/ubermenu/pro/assets/css/ubermenu.min.css?ver=3.7.4 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7ba7e664816f88dde2f3f9b789e427087a5deb8986f708dd02bcfe1c0d8ff55 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Sun, 13 Apr 2025 22:15:33 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-a-57d8d64c7d-vwdbt x-served-by cache-chi-kigq8000138-CHI, cache-ams21044-AMS last-modified Fri, 12 Apr 2024 07:16:06 GMT server cloudflare x-timer S1713821308.023119,VS0,VE3 etag W/"6618dfb6-1062c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2%2BUSt%2F%2F4EqRso%2BrhHIAs4YDj2SA5Jw0BXF0Mw%2FrrxhSq878e6qs68ftB7%2BMUjU18OOagtowENSgJUA7eGN05xbsz0l1QObg5ug3LH70sJIyMSuO2o%2Fzhgfhqn2dDUsfRco5fW9CLgx3n32UEokuo"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 2df85796-f91a-11ee-b983-a608f412765a cache-control max-age=31622400 cf-ray 879ace7c596c1e6a-FRA x-cache-hits 0, 4
GET H2	200	all.min.css www.securonix.com/wp-content/plugins/ubermenu/assets/fontawesome/css/	57 KB 13 KB	32ms 30ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/ubermenu/assets/fontawesome/css/all.min.css?ver=6.4.3 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-nrk6l x-served-by cache-chi-klot8100168-CHI, cache-ams21066-AMS last-modified Sat, 13 Apr 2024 21:41:41 GMT server cloudflare x-timer S1713821308.023619,VS0,VE2 etag W/"661afc15-e4d2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DBJRjNJ2YXjKLGDxy%2FluSYpVCpYiVHC6UJQ%2FOtmnnSQKNH6TWazMmvGB1cKQOSIjftfUQU3BHcX8lYcUjA9WlD6veWtuXce0roW4idri%2Bljrz8SHItE7wKEKn3Gc%2B9MB342%2B%2BULt31Ajvx7sSKaB"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 86f62558-fa6d-11ee-91c8-7af237c31095 cache-control max-age=31622400 cf-ray 879ace7c596e1e6a-FRA x-cache-hits 0, 4
GET H2	200	language-cookie.js Show response www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/	241 B 699 B	24ms 22ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.6.6 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d01e29303e11404333dd1293ed958ee09b41203f03b4083a48cc33a66700ffd0 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 cf-polished origSize=271 content-encoding br x-cache MISS, HIT x-cache-hits 0, 4 x-served-by cache-chi-klot8100114-CHI, cache-ams21029-AMS cf-bgj minify last-modified Sat, 13 Apr 2024 22:49:35 GMT server cloudflare x-timer S1713821311.635644,VS0,VE2 etag W/"661b0bff-10f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sWfRQ331G3kgKfsD2T47ZsVttMzgABY67Ozy4EZ0s4D8Dm4Mvaj1cajykxPgQquY8IG8fUTJeMBshKYVCg0uXvbaX8bptWKy8IIBZy%2BsB9mexKgQ%2BhYJxZ1ix8YOWtYo%2FjelNtZ%2BCaormfYEQG6J"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 86f86693-fa6d-11ee-810e-3e9b3257ad3f cache-control max-age=31622400 cf-ray 879ace7c596f1e6a-FRA x-pantheon-styx-hostname styx-fe2-b-77f64f9968-7pk4l
GET H2	200	page.js Show response static.addtoany.com/menu/	3 KB 2 KB	54ms 20ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/page.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e0cc78c402cbc02fdfd41cd77c5fd6ffbd8066cc07935ea8eb5f3fcc59744a3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10680 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"e346c2841e4abbb66ee259e9540abb61" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bWaDC6EoBz3kJJPA6O3B%2FpFQKI1AxR%2FlTozzpfn8tMfueroZULY4RhIyJJXqebt4eRVxpy%2BXBaWkC3dx1wiln%2FzAb0Dl3wvKXfcNJKwirOlTuaRz8Mu8ZeEaj8olIo2k%2BZpnkgxl"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=86400, stale-while-revalidate=30, public cf-ray 879ace7e0d2a4d38-FRA
GET H2	200	jquery.min.js Show response www.securonix.com/wp-includes/js/jquery/	86 KB 31 KB	32ms 31ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-57d8d64c7d-9ngfg x-served-by cache-chi-klot8100155-CHI, cache-ams21060-AMS last-modified Sat, 13 Apr 2024 22:49:37 GMT server cloudflare x-timer S1713821311.632141,VS0,VE2 etag W/"661b0c01-15601" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TGVb0uCokidr9PQyjvcdbuecc3SQRIKRnX%2FGlPKnrDeVvaiDIYqD2ALGEFsuHHEoEtuFhEzx4A6j85Pz%2BZRMZvgAsbSm2ccvDcZvE2JFe3FUja4ptrhQBrBedm8FYGtzRf%2FxszH7wvHgsquQGRDu"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 86f71d13-fa6d-11ee-93e3-aafe187c636f cache-control max-age=31622400 cf-ray 879ace7c59701e6a-FRA x-cache-hits 0, 4
GET H2	200	jquery-migrate.min.js Show response www.securonix.com/wp-includes/js/jquery/	13 KB 5 KB	31ms 29ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:41 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178952 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-bzdln x-served-by cache-chi-kigq8000086-CHI, cache-ams21072-AMS last-modified Sat, 13 Apr 2024 21:41:42 GMT server cloudflare x-timer S1713821311.629154,VS0,VE3 etag W/"661afc16-3509" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2M92b5dYsW5%2FCOcQXC%2Bajp9Zl11wacSFhEeUwrHcvyJxCfe0%2FcNvT80gMQWLbBlG0Y8GIZNu7Mh0DtI5vHgawWuyi0hrZxDQOlxQKyems65tmTgXD73cCKrXZo8WWgHrl59Z%2B1LRm5iD0T4g6noF"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 86f8888c-fa6d-11ee-94a7-1a3b08b151cb cache-control max-age=31622400 cf-ray 879ace7c59711e6a-FRA x-cache-hits 0, 7
GET H2	200	addtoany.min.js Show response www.securonix.com/wp-content/plugins/add-to-any/	129 B 561 B	17ms 16ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:42 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178943 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-hbk2r x-served-by cache-chi-klot8100064-CHI, cache-ams21052-AMS last-modified Sat, 13 Apr 2024 23:49:15 GMT server cloudflare x-timer S1713821308.276956,VS0,VE2 etag W/"661b19fb-81" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oJS9YpPIDxj4MztkMn0txeCkpfcsraHt%2Ftkp3nbdcDL2a0206zjXimeR3%2FXXweHWZDyos3kZayM0VuRiKY6GEdFjTY9DCz%2FYDYqAVTkmdjT4xKUgVBWUiSr64%2FFFH6sEkgfoNjj4Ct%2BwW5ufxve9"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 873ef1aa-fa6d-11ee-b096-6ee28b929e97 cache-control max-age=31622400 cf-ray 879ace7e0a951e6a-FRA x-cache-hits 0, 4
GET H2	200	image4-768x430.png www.securonix.com/wp-content/uploads/2024/04/	343 KB 344 KB	24ms 23ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/image4-768x430.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 78870e56a28616865f1b5f056c4d8798eb8c986ef4247e9cb903c47759f23140 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 18:38:26 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42612 cf-polished origFmt=png, origSize=538138 x-cache MISS, MISS x-cache-hits 0, 0 content-disposition inline; filename="image4-768x430.webp" content-length 351398 x-served-by cache-chi-klot8100077-CHI, cache-ams21072-AMS cf-bgj imgq:85,h2pri last-modified Mon, 22 Apr 2024 20:59:11 GMT server cloudflare x-timer S1713897506.420771,VS0,VE594 etag "6626cf9f-8361a" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KWqg6N%2BoAo%2BBV37cVVvSYUlhK0zWvxbbYIIX8TSYLrTxVkrWoxrj6NICC9JS0pAxXz%2BdOmHTbEDh6wDzfcryLoIfMhW%2FmaLVPnqjynupC8mN4VfVVAbZmFY%2FMES8WjMpVm7Qb5v7TBJskIN1zObe"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id ac0ed0bf-01a0-11ef-88ef-529cc7717b5c cache-control max-age=31622400 accept-ranges bytes cf-ray 879ace7c59721e6a-FRA x-pantheon-styx-hostname styx-fe2-a-7d9c76749d-vp9dc
GET H2	200	image2-768x452.png www.securonix.com/wp-content/uploads/2024/04/	169 KB 170 KB	31ms 30ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/image2-768x452.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9714e0f3da25ffe42e0898631d4f3da125d6e3c82061bfa963030ebf8926aaf9 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 18:38:26 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42612 cf-polished origFmt=png, origSize=230804 x-cache MISS, MISS x-cache-hits 0, 0 content-disposition inline; filename="image2-768x452.webp" content-length 173044 x-served-by cache-chi-klot8100048-CHI, cache-ams21048-AMS cf-bgj imgq:85,h2pri last-modified Mon, 22 Apr 2024 20:58:57 GMT server cloudflare x-timer S1713897506.434819,VS0,VE472 etag "6626cf91-38594" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5t2YM9ztZ64YVH%2Fl0Uu%2BBxdQBng72GyuXCasljSfP9Pd3WGq7Q5iwJ3CFUfry7T6QWt8OOCr%2Bp%2FwbY43I4ILFCAvjgAnOi1sbKUp%2Fzd3AQsmRZPQxXCWRRTYMCAN3yJRSSzAaycnkxxsYQ%2FMAwsp"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id ac111ca0-01a0-11ef-a88f-32e589a1b447 cache-control max-age=31622400 accept-ranges bytes cf-ray 879ace7c59731e6a-FRA x-pantheon-styx-hostname styx-fe2-b-76f6c9d98-8pj5p
GET H2	200	image1-768x452.png www.securonix.com/wp-content/uploads/2024/04/	107 KB 108 KB	30ms 29ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/image1-768x452.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8044a03f7f61ec94fd82991bc7bf3da95e0ae3e890053e3398534d4da395560b Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 18:38:26 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42611 cf-polished origFmt=png, origSize=145923 x-cache MISS, MISS x-cache-hits 0, 0 content-disposition inline; filename="image1-768x452.webp" content-length 109562 x-served-by cache-chi-klot8100171-CHI, cache-ams21082-AMS cf-bgj imgq:85,h2pri last-modified Mon, 22 Apr 2024 20:58:50 GMT server cloudflare x-timer S1713897506.415563,VS0,VE601 etag "6626cf8a-23a03" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YRWqJQQPSOKpyrIQEhj9xjJqF1Hmllsjl%2BG5o1nT8Chgk99z14N8H7RLacwRl6eVzsr4fd8ZeavN0GlehKT78Sukf2D3SaUcwkqC7MZXdfjRSJkvjLLcsc3a1X1lUZea7UjoKDlM0wbBI%2F3cC2Ti"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id ac0e7137-01a0-11ef-8e9e-46874754af03 cache-control max-age=31622400 accept-ranges bytes cf-ray 879ace7c59741e6a-FRA x-pantheon-styx-hostname styx-fe2-b-76f6c9d98-g5t4g
GET H2	200	image3-768x452.png www.securonix.com/wp-content/uploads/2024/04/	120 KB 121 KB	16ms 16ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/image3-768x452.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash adba1e4ca0f5f76a58da3ee5c24c5a1a0ab75dbdcfee943dda5a53283e7c736e Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 18:38:26 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42611 cf-polished origFmt=png, origSize=163267 x-cache MISS, MISS x-cache-hits 0, 0 content-disposition inline; filename="image3-768x452.webp" content-length 122792 x-served-by cache-chi-klot8100054-CHI, cache-ams21065-AMS cf-bgj imgq:85,h2pri last-modified Mon, 22 Apr 2024 20:59:04 GMT server cloudflare x-timer S1713897506.434947,VS0,VE185 etag "6626cf98-27dc3" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7zFvl7Q8PtDIVneNoFAh9lZjsbZMhfp68EgI9bxIbwOn7cwZeQRB8ecIz4%2B9opddUFhE5ADna%2Brw3AKsvU5DQTGLaTzSNcJhVXHOR8dYq%2F08oxgwjKe1N6t1ZNVgIQlynOeJQi5JlV7rg4ILGOcA"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id ac127a8b-01a0-11ef-811f-e627ebaa874e cache-control max-age=31622400 accept-ranges bytes cf-ray 879ace7c89931e6a-FRA x-pantheon-styx-hostname styx-fe2-a-7d9c76749d-7vdxr
GET H2	200	forms2.min.js Show response pages.securonix.com/js/forms2/js/	199 KB 67 KB	170ms 21ms	Script application/x-javascript	104.17.73.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pages.securonix.com/js/forms2/js/forms2.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 05 Mar 2024 19:24:48 GMT server cloudflare age 856 etag "422b0c-31af8-612eecb9f6000" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 879ace7d7fc9363d-FRA expires Thu, 25 Apr 2024 06:12:10 GMT
GET H2	200	jquery.powertip.min.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	11 KB 4 KB	17ms 17ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/jquery.powertip.min.js?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:42 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178951 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-hbk2r x-served-by cache-chi-klot8100113-CHI, cache-ams21033-AMS last-modified Sat, 13 Apr 2024 23:49:16 GMT server cloudflare x-timer S1713821308.266109,VS0,VE3 etag W/"661b19fc-2ae5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S21Lpc9RHeZuKNE2o5SrI0RLUhmXKzg6DyVpDSrfyKgVA83WbQUtHR0hFWyx1d%2FGr%2BXUj97NIxAWVM5k4c4PacyqdCdyxtvFqN3HxctgEtsEkPJnXqc9HUaAfLlLETKngtLRZv91qxwYhRljDvDw"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 87369e46-fa6d-11ee-b096-6ee28b929e97 cache-control max-age=31622400 cf-ray 879ace7ca9a01e6a-FRA x-cache-hits 0, 4
GET H2	200	maps_points.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	504 B 757 B	21ms 21ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/maps_points.js?ver=1.2.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb698b4af30a506bea5e24025b0f742db88461e40a7f9f2f24293ad810bdf842 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:42 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 7679 cf-polished origSize=606 content-encoding br x-cache MISS, HIT x-cache-hits 0, 4 x-served-by cache-chi-klot8100147-CHI, cache-ams21046-AMS cf-bgj minify last-modified Sat, 13 Apr 2024 07:30:43 GMT server cloudflare x-timer S1713821308.274312,VS0,VE3 etag W/"661a34a3-25e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=labe5whCTgqd86dFIudb7Gzw9gZxcKA2I1uOQPsI82gWOBn11CfkyrlHkE6m1%2FxyaXL8WdjQ7Fw0l6IxXoLVN13e9R0YnSxGKNM4YE5IMPyNE6v9uqhxH7nsydhiabyyMBdoDWQhF%2FPW1uSE4W4K"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 873e611d-fa6d-11ee-93e3-aafe187c636f cache-control max-age=31622400 cf-ray 879ace7cc9c41e6a-FRA x-pantheon-styx-hostname styx-fe2-a-57d8d64c7d-9ngfg
GET H2	200	modernizr.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	16 KB 6 KB	18ms 18ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/modernizr.js?ver=1713887471 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8f060e210fa92b0bce82108a417cbf3f4f0ded2dc69a8b293db44da9f4b24c23 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 16:01:25 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42611 cf-polished origSize=50144 content-encoding br x-cache MISS, MISS x-cache-hits 0, 0 x-served-by cache-chi-kigq8000119-CHI, cache-ams21072-AMS cf-bgj minify last-modified Tue, 23 Apr 2024 03:46:53 GMT server cloudflare x-timer S1713888086.904047,VS0,VE137 etag W/"66272f2d-c3e0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axNpWHcC%2BtiuV%2FftxYXQh0RDXcX2GDtYLlyqvevq%2FGUSIDCxvUbysUbA5oYRbdcYQwhbOGdJBryfkQgI40%2F6S9FjJ%2F254K6lxeGGRPKFinexkzJMiIRd8Q0SGlOejjtITT9Fp9h5QWHcALt7cuEP"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id bcfdbed0-018a-11ef-93c2-66bc493bf3ef cache-control max-age=31622400 cf-ray 879ace7ce9d61e6a-FRA x-pantheon-styx-hostname styx-fe2-a-7d9c76749d-t244p
GET H2	200	wow.min.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	8 KB 3 KB	17ms 17ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/wow.min.js?ver=1713887471 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7852a22b72ead62cfc4a1b1ca32874b3e222f232a991a6d1432313572f534135 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 16:01:25 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42611 content-encoding br x-cache MISS, MISS x-pantheon-styx-hostname styx-fe2-a-7d9c76749d-8jqjj x-served-by cache-chi-kigq8000055-CHI, cache-ams21048-AMS last-modified Tue, 23 Apr 2024 03:46:53 GMT server cloudflare x-timer S1713888086.894801,VS0,VE120 etag W/"66272f2d-1fdb" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Q4U3HyWtsoJTtNu5%2BnlseZ0b0G6yAm%2FHbSD3Rg9y9GrCuFrMoSTbb6q8tSJt6RUjiLZdlnAY2bAQFrQVriPiId8J1gF%2BkmNDhaa7CWFY6DHF%2BshRgHMNToMLtK7W8CEpqxeGyqCqsPAEm1hAyEy"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id bcfd08e9-018a-11ef-8a2d-862ce7c87cde cache-control max-age=31622400 cf-ray 879ace7d09e21e6a-FRA x-cache-hits 0, 0
GET H2	200	select2.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	100 KB 24 KB	22ms 22ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/select2.js?ver=1713887471 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ba711f4ae1f09fd05735a7b8ec5e0d70d271cf09212431fa192deaed9a324360 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 16:01:25 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 7678 cf-polished origSize=155132 content-encoding br x-cache MISS, MISS x-cache-hits 0, 0 x-served-by cache-chi-klot8100028-CHI, cache-ams21026-AMS cf-bgj minify last-modified Tue, 23 Apr 2024 03:31:48 GMT server cloudflare x-timer S1713888086.892142,VS0,VE150 etag W/"66272ba4-25dfc" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JM5qO8EVTGQRIvZvDXqaMt8ayzBm0bdWdziLtBSKvTY3mCyGZo8chnOlH3zpZdLuIsCAFP%2FItAj3S3J%2B0RHyxsiAEHofweBeYXiX6HUxh5WLIJcsL5pNyraOuZKY1Mym4XTJbC0wMX6NY93C9mS2"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id bcfc2a9a-018a-11ef-811f-e627ebaa874e cache-control max-age=31622400 cf-ray 879ace7d29ee1e6a-FRA x-pantheon-styx-hostname styx-fe2-a-7d9c76749d-7vdxr
GET H2	200	slick.min.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	36 KB 10 KB	20ms 20ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/slick.min.js?ver=1713887471 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22529609ad54b33ee1695008d3daa6e35f133849c49ee00d7e9bc02eb0dd9a56 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 16:01:26 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42611 content-encoding br x-cache MISS, MISS x-pantheon-styx-hostname styx-fe2-b-76f6c9d98-q8wht x-served-by cache-chi-klot8100021-CHI, cache-ams21059-AMS last-modified Tue, 23 Apr 2024 03:32:49 GMT server cloudflare x-timer S1713888086.912733,VS0,VE179 etag W/"66272be1-9040" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oNcy44m3b13EhArPa7CNmZXcd7xDGbY%2F1Ytjt9kcopKROFZg2ZVTAWfSuiYeeqfYZcRcmnesf8jtjDrGQNCeBMLgSIVMK4VtLT7OKNc%2Byg4r8UptXYqhwb3FctwXwcynKhBN3KMuPEfIq%2BiPNgMR"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id bd05c3e2-018a-11ef-b5ab-5ebfcd969e79 cache-control max-age=31622400 cf-ray 879ace7d5a021e6a-FRA x-cache-hits 0, 0
GET H2	200	scripts.min.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/	171 KB 45 KB	22ms 22ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/scripts.min.js?ver=1713887471 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a5dc25b44f66a4a97302932d4e42507562ecd23f893b1669a791662a8ec00542 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 24 Apr 2025 16:01:26 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42611 content-encoding br x-cache MISS, MISS x-pantheon-styx-hostname styx-fe2-b-76f6c9d98-8pj5p x-served-by cache-chi-kigq8000046-CHI, cache-ams21072-AMS last-modified Tue, 23 Apr 2024 15:51:11 GMT server cloudflare x-timer S1713888086.322706,VS0,VE170 etag W/"6627d8ef-2ace1" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lo2bCMsUwLeAsfWvhB0AGJ8%2FHng8FxI42fflnGFKhNivYODwK5xcBXLHy6GMFYw%2BY%2BgZrPxCr591F0JhDYm%2Fg2yzG39Vhb0Tl5l1x4gCTS1TehsVj9VwrBS34OKRS%2Bcr%2Bw5GB0KAZhBW6BaZjv6R"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id bd3db442-018a-11ef-a88f-32e589a1b447 cache-control max-age=31622400 cf-ray 879ace7d7a1b1e6a-FRA x-cache-hits 0, 0
GET H2	200	new-tab.js Show response www.securonix.com/wp-content/plugins/page-links-to/dist/	24 KB 9 KB	18ms 18ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.6 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:42 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178943 content-encoding br x-cache HIT, HIT x-cache-hits 0, 4 x-served-by cache-chi-kigq8000041-CHI, cache-ams21037-AMS cf-bgj minify last-modified Sat, 13 Apr 2024 23:49:16 GMT server cloudflare x-timer S1713821308.274952,VS0,VE2 etag W/"661b19fc-609e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sLqzPr%2FwyUSnYGduY6bhxvkbNHz2JdI2NqcE2wZSlpBK%2BZoJ9Rgzy7CeymI%2BtRDqoL2u8NWGinY95LXgfFVAecFr7SsuOBU8m5OpCSyJ9JcabIER6sAdjbF7R5AG5xcPookd48Pvt6v3AUhLEAQW"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 873f8c37-fa6d-11ee-93a3-66529c49ef00 cache-control max-age=31622400 cf-ray 879ace7d9a291e6a-FRA x-pantheon-styx-hostname styx-fe2-b-77f64f9968-rm6p6
GET H2	200	ubermenu.min.js Show response www.securonix.com/wp-content/plugins/ubermenu/assets/js/	38 KB 10 KB	18ms 17ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/ubermenu/assets/js/ubermenu.min.js?ver=3.7.4 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 58415d97eb0b5745ccfa6e5e2f996581ec39f6c4af80627d3dd3c06bc5977ca6 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:42 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178943 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-nrk6l x-served-by cache-chi-kigq8000049-CHI, cache-ams21072-AMS last-modified Sat, 13 Apr 2024 22:49:36 GMT server cloudflare x-timer S1713821308.275254,VS0,VE2 etag W/"661b0c00-9750" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z4vXogdGghb8hkdDL7n57tK6UZKfg23JKVle7bCJ2w4sivMMLzh4Rdv5YLfWY2y4%2BaLu11zvnrId9dPND2QW3EKyHk%2BZ6%2F2ML1AfbYTGiS%2F%2Bq5jYCY1Fob7rtZZw3d5Paly8cibG%2FL4wjGnOH2Om"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 87400aba-fa6d-11ee-91c8-7af237c31095 cache-control max-age=31622400 cf-ray 879ace7daa2f1e6a-FRA x-cache-hits 0, 4
GET H2	200	smush-lazy-load.min.js Show response www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/	8 KB 4 KB	18ms 17ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.14.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 15 Apr 2025 14:44:42 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178943 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-bzdln x-served-by cache-chi-klot8100173-CHI, cache-ams21047-AMS last-modified Sat, 13 Apr 2024 22:49:36 GMT server cloudflare x-timer S1713821308.281265,VS0,VE3 etag W/"661b0c00-1ef2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AlO%2FlfzuIAbJjLf48scrYXQFdEpkSZUc9lqH1P%2BbzoHjAYo0g7RHK2DyHb468pzm6M47%2BCYZzXwESPdwDkFbga3Wn8xfn7cIEzLWmXyzLmxVV%2FKfINSNuciTTIu1k39PsLwSrR%2B288RsSDBsUxRl"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 873f9309-fa6d-11ee-94a7-1a3b08b151cb cache-control max-age=31622400 cf-ray 879ace7dca411e6a-FRA x-cache-hits 0, 4
GET H2	200	p.css p.typekit.net/	5 B 172 B	58ms 15ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=pjm0fus&ht=tk&f=26034.26052.26053.26054.26055.26056.26057.26058.26059.26060.26061.26062.26063.26064.26065.26067.26068.26069.25998.25999.26000.26001.26016.26017.26018.26019.26036.26037.26046.26047.26070.26071.26072.26073.26074.26075.26076.26077.26078.26079.26080.26081.26082.26083.26086.26087&a=92827302&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT last-modified Fri, 23 Jun 2023 17:09:47 GMT server nginx etag "6495d1db-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	325ms 33ms	Script application/x-javascript	2.23.65.88 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.23.65.88 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-23-65-88.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 25 Apr 2024 02:12:10 GMT Content-Encoding gzip Last-Modified Fri, 17 Mar 2023 01:24:48 GMT Server AkamaiNetStorage ETag "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Length 729
GET		lt-v3.js lltrck.com/scripts/	0 0
GET H2	200	gtm.js Show response www.googletagmanager.com/	297 KB 100 KB	56ms 27ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cc72209931cce417c2bb09005e2858e3bdb23f84434b020443af956fa4d3e637 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 102209 x-xss-protection 0 last-modified Thu, 25 Apr 2024 00:05:28 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 Apr 2024 02:12:10 GMT
GET BLOB	200 OK	2c019f96-1a6f-49e2-8257-3e4ae58a64c1 https://www.securonix.com/	1 KB 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.securonix.com/2c019f96-1a6f-49e2-8257-3e4ae58a64c1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 1245 Content-Type text/javascript
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	hero-coverage.png www.securonix.com/wp-content/uploads/2022/04/	3 KB 4 KB	17ms 17ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2022/04/hero-coverage.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfb9e92353e3d4999e02a6f01a3551a87686ebf0180baf65b4c961f7061bcf52 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-pantheon-styx-hostname styx-fe2-a-756dd76fc7-j7qzn date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 42611 cf-polished origFmt=png, origSize=10885 x-cache HIT, HIT expires Fri, 28 Mar 2025 11:19:19 GMT content-disposition inline; filename="hero-coverage.webp" backend-name 34.123.8.55,9093 content-length 3564 x-served-by cache-chi-klot8100063-CHI, cache-ams21053-AMS backend-ip-port 6wd67qj6gjWStoHWt9QqLM--F_styx_fe2_a_sharedvpc_dmz_01 cf-bgj imgq:85,h2pri last-modified Wed, 20 Apr 2022 17:31:36 GMT server cloudflare x-timer S1713826754.792869,VS0,VE2 etag "62604378-2a85" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ocHgPLRaYjPH6dYGvFm5R0P%2FC0GupbuyRwBh%2FGke%2BouXe%2Ba57qHYv9UtuoWwCOofW3OUKRnrIu%2Fi11hkVSxPXIz61vIPo6IgesqQf57mFqNPS1W5eVuCJHeLePzceGQnORYyBd3%2B%2Fy8DAvRqctYz"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id dab83f0f-ec2b-11ee-92ab-86c79b107cd4 cache-control max-age=31622400 accept-ranges bytes cf-ray 879ace7e2aa31e6a-FRA x-cache-hits 0, 0
GET H2	200	l use.typekit.net/af/46da36/00000000000000003b9acaf6/27/	26 KB 26 KB	27ms 7ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/46da36/00000000000000003b9acaf6/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 464b561ee00c86db1cddb80f2c9d6febbc2c1aa95f422fa73a4fb8ef7d5d5028 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT server nginx etag "de29fb2e3e401b15877c6b3a0953702fe7fa1105" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 26812
GET H2	200	icomoon.ttf www.securonix.com/wp-content/themes/securonix/assets/fonts/icons/	5 KB 5 KB	17ms 15ms	Font application/x-font-ttf	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/fonts/icons/icomoon.ttf?folamw Requested by Host: www.securonix.com URL: https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1713887471 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a4d1cf1412729a6ebf14ef0c798f0b9c9dc0ecee9e06e912859e4c53380fb33b Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1713887471 Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Mon, 14 Apr 2025 02:48:09 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178949 x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-a-57d8d64c7d-x4qsl x-served-by cache-chi-kigq8000049-CHI, cache-ams21045-AMS last-modified Fri, 12 Apr 2024 08:58:32 GMT server cloudflare x-timer S1713821308.417513,VS0,VE3 etag W/"6618f7b8-1358" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mFZG4IbaQUD1Nak7Yl3IslGkF0vAOprltQ7WuL0nhSiawBqFKKSjmTQKnBt75vKM0DB6dU%2BZmHNYrEanOAWFia1%2FzFlXSxxCSfoV39I74U5W9ftsBkU6Ncthpua2Yfx9LsDP9rbmsCgQbKANsTYe"}],"group":"cf-nel","max_age":604800} content-type application/x-font-ttf access-control-allow-origin * x-styx-req-id 4302e881-f940-11ee-a59a-defe53ce599e cache-control max-age=31622400 cf-ray 879ace7e6ac61e6a-FRA x-cache-hits 0, 3
GET H2	200	QGYsz_wNahGAdqQ43Rh_fKDp.woff2 www.securonix.com/fonts.gstatic.com/s/worksans/v19/	49 KB 50 KB	31ms 28ms	Font font/woff2	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT cf-cache-status HIT last-modified Thu, 14 Sep 2023 01:13:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 10980 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lRjkNPaQ8AemSlRQKRvlnUhlLdQIzXqdmSTleHz5D%2FY1kUpnDijHZo9NB7LdJ%2BwpMNwZjMGvDlipEcEICnvr2JX9VXXggqJ4vckTjTjFnZp%2FVWHMzqXRmAgtqm4OLG7wkJU826qhhO1LkwP4KITB"}],"group":"cf-nel","max_age":604800} content-type font/woff2 cache-control public, max-age=31536000 cf-apo-via proxy accept-ranges bytes cf-ray 879ace7e6ac71e6a-FRA content-length 50668
GET H2	200	l use.typekit.net/af/027dd4/00000000000000003b9acafa/27/	18 KB 19 KB	33ms 14ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/027dd4/00000000000000003b9acafa/27/l?subset_id=2&fvd=n6&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash deb1aa1c2af7a0f084b58e34c78545593305a87b23f9f6e099849c1ace0c9dd6 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT server nginx etag "de3ec5612df14c88441e596fbc2c46580ea46ed7" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 18912
GET H2	200	l use.typekit.net/af/829fc1/00000000000000003b9acaf8/27/	19 KB 19 KB	31ms 12ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/829fc1/00000000000000003b9acaf8/27/l?subset_id=2&fvd=n5&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 841ec96a41283cf23db2d69fe67d9beee3e9b222bccfe81ecf6edefc78e92151 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT server nginx etag "7fe86a8b0e0aad464390eb5e39aa627a47e9886d" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 18988
GET H2	200	l use.typekit.net/af/6d4bb2/00000000000000003b9acafc/27/	26 KB 26 KB	28ms 9ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/6d4bb2/00000000000000003b9acafc/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash da03f140d305f2abdf496bdd3fad9cfed87a237cf09f6a2edcec58bc5a1f044d Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT server nginx etag "7d4a321fb4284bed9856c33aee6c065aba0855a7" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 26392
GET H3	200	sm.25.html static.addtoany.com/menu/ Frame 549F	0 0	30ms 20ms	Document text/html	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/sm.25.html Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-origin * age 27367 alt-svc h3=":443"; ma=86400 cache-control max-age=315360000, immutable cf-cache-status HIT cf-ray 879ace7ebfb0365c-FRA content-encoding br content-type text/html; charset=utf-8 date Thu, 25 Apr 2024 02:12:10 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zf100L6iTlFg050p7ry6jRCgFGHrlS0bsxSt474zPbv6Js%2FpRKoLWALzrYpDxRf3QjEFWUE4M2zn0fPIU%2FMuTy3YgdnJMM4pjeMhyeSgmPbO3S%2BATW9DbP6u5N%2FFxnuqjOOjZMjq"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff
GET H3	200	core.BRQnzO8v.js Show response static.addtoany.com/menu/modules/	70 KB 26 KB	31ms 19ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 91b9b24f0aa59668e4d0a770ee7a294b9baa361a76a20ade8128cd0482a5d805 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10980 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"25da5432b1057724b8210f17e9b9db05" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aIwQChulJpDKCBej53VI8mHVL8cAGy9hJPiB0m0sX2FFXGG%2FID%2Bp%2BGoNrilcQiPfw8U%2B4M9JK045eQFzkW0XZcZkdgD19GM4HWwPwltJm1mIJqpgL6zU8RexvOi56urg9bY83Ggw"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=315360000, immutable cf-ray 879ace7eba209250-FRA
GET H2	200	securonix-blue.svg www.securonix.com/wp-content/uploads/2021/07/	4 KB 2 KB	16ms 15ms	Image image/svg+xml	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2021/07/securonix-blue.svg Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3a484da0ec050bccd6034a00ee39c4919c49ca749d0510f934a9ff5a07251a6c Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Fri, 04 Apr 2025 08:48:30 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178941 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-69d889f459-45grk backend-name 34.123.8.55,9093 x-served-by cache-chi-klot8100025-CHI, cache-ams21054-AMS backend-ip-port 6wd67qj6gjWStoHWt9QqLM--F_styx_fe2_a_sharedvpc_dmz_01 last-modified Fri, 03 Dec 2021 17:18:42 GMT server cloudflare x-timer S1713821308.032972,VS0,VE4 etag W/"61aa5172-f3a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sH1C1T3ycbyf%2F01W5%2FtmShIoTf0qi6hGox5jydd5rQr6gO9451CPIRe%2Bo%2BySDpJ0p%2F5rRVQLFKysNc8cFZ3ZpbmV3Pw76lZJ0EFZMJIhAnqHv4mOuLQsg72kG8TjjUZfZpyIEIYMBpd3Zp%2BehqKZ"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * x-styx-req-id f1e99d13-f196-11ee-bb35-7eb206d4b2da cache-control max-age=31622400 cf-ray 879ace7efb0b1e6a-FRA x-cache-hits 0, 0
GET H2	200	base.js Show response embed.formhq.net/v1/	6 KB 3 KB	128ms 16ms	Script application/javascript	2606:4700:3108::ac42:283b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embed.formhq.net/v1/base.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 5161 cf-polished origSize=6385 x-xss-protection 1; mode=block cf-bgj minify last-modified Tue, 01 Nov 2022 14:37:50 GMT server cloudflare etag W/"63612f3e-18f1" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r2YuEamqLU%2BY2YJ55nzDmnQ%2FSSb5ajWDsR%2FvCVveBknIB7031H8EUQHrZSTSr%2FC7HSSuFFUbWl0vww7QbCxJugwpTP605A1L1YDC2QSZe7e2JUIYNX3mEyg1XAPUFP0fMayyCa%2B62OjopxqXDXQC"}],"group":"cf-nel","max_age":604800} cache-control max-age=1800 cf-ray 879ace7fdf5c3a52-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	271 KB 94 KB	31ms 30ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f42370c195f9d3cddfe0bb0eb0431fc292f51c0bfd7d4cd3c112a0aa3c5eb2bd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 96061 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 25 Apr 2024 02:12:10 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	65 KB 18 KB	120ms 12ms	Script application/javascript	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash ad7401d2e529b7d3c45e9f5fb1fdcbd16c4cc8d96d74cfaaf0c09896b0cccab3 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:10 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 09 Apr 2024 21:38:48 GMT server nginx/1.14.0 (Ubuntu) etag "6615b568-10322" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 17836 expires Thu, 25 Apr 2024 02:12:10 GMT
GET H2	200	attributor.min.js Show response cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/	7 KB 3 KB	129ms 20ms	Script application/javascript	2606:4700::6810:5714 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/attributor.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 18379 x-jsd-version master content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-etou8220072-FRA, cache-lga21958-LGA x-jsd-version-type branch server cloudflare etag W/"1da1-KfePJ46ikK9jPpNwOZncE3ivfdg" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LyiYmzoaZzwGbo4xzfH9zZUzYhhrMgql195IvD78bCth5SWIvgwnOU5jkLTzpXw%2FGqJhxKC5nac%2BuF6A%2FRq4HYaPgya9pzaUY9i5JKVQOtCUr9hTcXQ2liPxmp05d0jz2THLsbVkPNsbFn6%2B%2B%2Fo%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cf-ray 879ace7fdc9e30d0-FRA
GET H2	200	destination Show response www.googletagmanager.com/gtag/	221 KB 79 KB	28ms 28ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-1004449086&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 614a82383815eb7b515abf81c9160c42c0728b0de123c15dc96b2482f0651aea Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80916 x-xss-protection 0 last-modified Thu, 25 Apr 2024 00:05:28 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 Apr 2024 02:12:10 GMT
GET H2	200	bat.js Show response bat.bing.com/	45 KB 13 KB	142ms 32ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Thu, 25 Apr 2024 02:12:10 GMT last-modified Thu, 29 Feb 2024 19:58:06 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: D16845A141094704807A6BC64CBD1F98 Ref B: FRA31EDGE0119 Ref C: 2024-04-25T02:12:10Z etag "01b4e9c496bda1:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 13261
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	48 KB 17 KB	122ms 8ms	Script application/javascript	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 09 Apr 2024 07:42:51 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=54945 accept-ranges bytes content-length 17238
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	85 KB 27 KB	108ms 8ms	Script text/javascript	2600:9000:2644:7c00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:7c00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 4196ef94fe2c7befda378bfaad82f3e662be2b5eb1ba9aeffce466ba6bfd0bd4 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers X-Amz-Version-Id zwiFd6r3GuB2cGe7uW1NAFDjPwo1YxA2 Content-Encoding gzip Via 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront) Date Thu, 25 Apr 2024 01:35:47 GMT Age 2186 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Tue, 23 Apr 2024 14:35:04 GMT Server AmazonS3 Etag W/"df5969d54f039097b5fc81144fa45a1f" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id wdYOtTLdlZLQKJV8COcWYn0vZYpsy2cKHPg_Dj1cR4bFNENwGAcnfQ==
GET H2	200	web-vitals.iife.js Show response unpkg.com/web-vitals@3.5.2/dist/ Redirect Chain https://unpkg.com/web-vitals/dist/web-vitals.iife.js https://unpkg.com/web-vitals@3.5.2/dist/web-vitals.iife.js	7 KB 3 KB	17ms 17ms	Script application/javascript	2606:4700::6811:f5cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/web-vitals@3.5.2/dist/web-vitals.iife.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Server 2606:4700::6811:f5cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c0e1f95aa09754b10449fd8cd7f2e76d8f232d1038b6cf7454db558ac79962e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers date Thu, 25 Apr 2024 02:12:10 GMT via 1.1 fly.io x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 3658330 last-modified Sat, 26 Oct 1985 08:15:00 GMT fly-request-id 01HRWFH5XK9ND0J2MZ4B7JGPSN-fra server cloudflare etag W/"1bff-XBuNuslfZI/SL2xuiJqqum43R9A" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 879ace802b125d39-FRA Redirect headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding br via 1.1 fly.io cf-cache-status HIT fly-request-id 01HW9FVXZ42AB78MDWF68YXDS6-fra x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 545 server cloudflare vary Accept, Accept-Encoding content-type text/plain; charset=utf-8 access-control-allow-origin * location /web-vitals@3.5.2/dist/web-vitals.iife.js cache-control public, s-maxage=600, max-age=60 cf-ray 879ace7feafa5d39-FRA
GET H2	200	r32rm8p2zmht.js Show response js.driftt.com/include/1714011300000/	221 KB 62 KB	348ms 237ms	Script application/javascript	18.245.86.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1714011300000/r32rm8p2zmht.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.77 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-77.fra60.r.cloudfront.net Software istio-envoy / Resource Hash 28e132ea525a5b852dc1a77fcadc939ba1b70d68f321dd2ddeedc4b8a8cb93ec Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT x-amz-version-id ECpAIUHXvnHr64vvrQweEad8ZWUjBUSY content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront x-envoy-upstream-service-time 41 last-modified Thu, 04 Apr 2024 20:13:54 GMT server istio-envoy etag W/"d320e83a1b98d0793815b4e22b96825b" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-cache access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 7buz9aL8HYX3dcdHmo2W2z8e0mkLHr-LBF4LUCdkaFbIDegpdooweA==
GET H2	200	wp-emoji-release.min.js Show response www.securonix.com/wp-includes/js/	18 KB 5 KB	17ms 16ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.3 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 17 Apr 2025 04:24:08 GMT date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 178941 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-77f64f9968-rdqmx x-served-by cache-chi-kigq8000062-CHI, cache-ams21049-AMS last-modified Mon, 15 Apr 2024 13:09:29 GMT server cloudflare x-timer S1713821311.229853,VS0,VE3 etag W/"661d2709-4904" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wOlXJWx3wn0DmROi8bHMtVd3EBdjsKsIfrn%2FLdEWI9S8zAYrqDA6bMqZh2BrIs7IYYabOMI39S0N0Q7noEpNvI7A9uJzgw3NuHa52kIfj3QnI38N6WseCFqsGaX8o%2BLgo4uRsnZmTH%2FQ%2B%2Fi0FjDc"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 2ac309aa-fba9-11ee-a628-ee5a0d4b28d2 cache-control max-age=31622400 cf-ray 879ace7f3b271e6a-FRA x-cache-hits 0, 3
GET H2	200	de.js Show response static.addtoany.com/menu/locale/	750 B 766 B	25ms 21ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/locale/de.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 22684 cf-polished origSize=902 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"86610d84a116a5704d658324728b063f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2BMnTJJlZRHBjN69HaXSzmwF9gNjDU%2Fi69miNKSJzBBAk4ko6u76JbkqaUMPqmqraFbhaicS%2FdVhfoiFQTiHJ80A5SQxFCji%2BYRiKLictdGe9xCzgrH7IZfYAA%2BwPeDDBuFehK77"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=86400, stale-while-revalidate=30, public cf-ray 879ace7f6dce4d38-FRA
GET H3	200	linkedin.js Show response static.addtoany.com/menu/svg/icons/	435 B 823 B	20ms 18ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/linkedin.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10980 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"00b1b78053ab07c79bfea2e5a1db9d70" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QVCjNiXdfYeQ57F6Q3THNbtbXQJ7d0urDKKNcauKZLDh5LnEYs%2Fi9%2BoEfammb9%2B4XiXM%2F547cfhmlLwgZsU4ugCRZJsfWCTFmJwifV1m1JyHkzf3nsiZNDFlvaj5AwhDt54Tc4vW"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 879ace7f6a4e9250-FRA
GET H3	200	twitter.js Show response static.addtoany.com/menu/svg/icons/	645 B 926 B	19ms 17ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/twitter.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3003867b66a32c12fdafeefc27cf06d906e5a99ba275550ab757f4bb04834636 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10980 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"af2b829f9b79fabec7c0148a8b7e444b" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CX7WFqhqnNHMMR53GmLDdTqQeWEs%2F%2BLr%2BClu5YTDrkAfj%2Fudofj%2F1dCIrGwqKxvpYXmHpCRvCF0t5UW4jlPMJpVZ1SVZXuuqLivdyASjSFhOh%2B9oeTGDiHvDXTJmiVFqNTVCUgqG"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 879ace7f6a4f9250-FRA
GET H3	200	facebook.js Show response static.addtoany.com/menu/svg/icons/	429 B 827 B	19ms 18ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/facebook.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b475960843a5619b907af1f0a89e3136bd5e6a4a700ec78cb417f302647cf49 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10980 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"68925fa8e347041c6006837e73c518bc" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UfHhy7OXzHBuMb38k%2BXSOp5F%2FChjRoyA1%2BagcBjLp1rWofUehbLGTk73Vz6PzLhx195IaJ%2B%2F7J0ah5IAMLoJ3ZrBs%2BiiPwtacuGAo3G0fItRK97oKvdDfoS68hJS9BEqm8SDLIHB"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 879ace7f6a509250-FRA
GET H3	200	a2a.js Show response static.addtoany.com/menu/svg/icons/	182 B 677 B	17ms 15ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/a2a.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10980 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"0aca4ea1e5f8f250126a8e0c597dd969" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BztL0HUKhkZYI8fWOEeVmMCd7t%2BzXcK9WqkRXWZrxU7Ety5xgoeBs0y1uZpsFcKCJXZgagilOUM0JbMcwEqmHVDLQvskoXs0%2B9BjXqQd2RnwM1xbqdDrKi65Yhh9sILNP7PT2fRx"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 879ace7f6a519250-FRA
GET H3	200	email.js Show response static.addtoany.com/menu/svg/icons/	415 B 817 B	16ms 15ms	Script application/javascript	2606:4700:10::ac43:2794 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/email.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://static.addtoany.com/menu/modules/core.BRQnzO8v.js Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10980 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"eb2119ad4221a9d01abc336e06962867" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DDV2bJwEURJdfRGxEY%2BAtbi3M4siqddX98YKi7FBQ%2F2rLolW8aTxxMvsfK7uLpSuNSNL47mqyoNIHV6m0lUA4QZ73%2BhVOUzVctR5YMTLrpOmzl%2By4IZ2mwpOkgbb3k8I3LwawBdJ"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 879ace7f6a539250-FRA
POST H2	204	collect region1.analytics.google.com/g/	0 256 B	44ms 16ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je44o0v891181397za200&_p=1714011130.907&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=299212152.1714011131&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&sid=1714011130&sct=1&seg=0&dt=Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=721 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:10 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 256 B	60ms 19ms	Ping text/plain	2a00:1450:400c:c09::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JPYDLXGD3Q&cid=299212152.1714011131&gtm=45je44o0v891181397za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:10 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	47ms 29ms	Image image/gif	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JPYDLXGD3Q&cid=299212152.1714011131&gtm=45je44o0v891181397za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=2017908049 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:10 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/ Redirect Chain https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js https://s.adroll.com/j/pre/index.js	0 756 B	8ms 8ms	Script application/javascript	2600:9000:2644:7c00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/index.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol HTTP/1.1 Server 2600:9000:2644:7c00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers X-Amz-Version-Id nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy Date Wed, 24 Apr 2024 04:14:55 GMT Via 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront) Age 79036 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Last-Modified Wed, 15 Jan 2020 23:54:18 GMT Server AmazonS3 Etag "d41d8cd98f00b204e9800998ecf8427e" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id dpdExINn4pK3GAMjvMs7jZ3yKZ4pwVq6bWXV2LGDRcUbdSlTj4H71g== Redirect headers Date Thu, 25 Apr 2024 00:33:14 GMT Via 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront) Age 5935 X-Amz-Cf-Pop FRA60-P6 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Location https://s.adroll.com/j/pre/index.js Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Access-Control-Allow-Headers * X-Amz-Cf-Id IqPYKk0Vs4OxIAZpnY25NoBamtVHZh_aCywIY7r-RQZHXMomDqtefw==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/	9 KB 4 KB	16ms 7ms	Script text/javascript	2600:9000:2644:7c00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/index.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:7c00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers X-Amz-Version-Id qMw0hUZztAJRDbnLXyRBSNN1sEfLmNeB Content-Encoding gzip Via 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront) Date Thu, 25 Apr 2024 01:57:59 GMT Age 852 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Mon, 22 Apr 2024 11:46:12 GMT Server AmazonS3 Etag W/"706be4fd28aeb971d2ff83a528c2073a" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id TBpi3LKNS7AgH51g4dkRVRUIiCPom0jXhr2CB8EItpWWFTgCGmk7-g==
GET H2	200	bWFya2V0bw.js Show response embed.formhq.net/v1/platforms/	422 B 574 B	14ms 14ms	Script application/javascript	2606:4700:3108::ac42:283b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embed.formhq.net/v1/platforms/bWFya2V0bw.js Requested by Host: embed.formhq.net URL: https://embed.formhq.net/v1/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6359 cf-polished origSize=423 x-xss-protection 1; mode=block cf-bgj minify last-modified Tue, 02 Aug 2022 14:00:38 GMT server cloudflare etag W/"62e92e06-1a7" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kx26Qscdq5igTu5w9%2F61k4%2F5u3SLkKUwRUahpmioV7rss1bDVmrLSPbeniTXT5E8LoQahElv%2B2BUhh6q5ONCfZZewYNw8arZYSZL22%2BckZ3rJ6T3lmKRUmIezvAJckh1uR1H3LnRzgVe5Wuvinxm"}],"group":"cf-nel","max_age":604800} cache-control max-age=1800 cf-ray 879ace804fad3a52-FRA
GET H2	200	/ Show response c.6sc.co/	7 B 195 B	32ms 10ms	XHR text/html	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.securonix.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 337 B	51ms 9ms	XHR text/html	2a02:26f0:480:23::1726:62a7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:23::1726:62a7 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash d863a5d9ec082f8802ffec7afb79ec2b86650e575984b0816de58549c8816b45 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:10 GMT vary Origin content-type text/html access-control-allow-origin https://www.securonix.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a02:6ea0:c71b:0:1011:591f:d013:381a server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1714011130967_388391911_53000450_22_812_6_16_219";dur=1 content-length 36 expires Thu, 25 Apr 2024 02:12:10 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	110ms 101ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A10%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=11e2f684-8693-457d-8207-8c0888ffe688&v=1.1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:11 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:11 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	110ms 101ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20Apr%202024%2002%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205b12115ad17914938bf7667643ca0d3%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20Apr%202024%2002%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20Apr%202024%2002%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20Apr%202024%2002%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2245bc92abc111f3fccbf9c8779059ecfc1d69c9e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20Apr%202024%2002%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=11e2f684-8693-457d-8207-8c0888ffe688&v=1.1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:11 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:11 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	32ms 32ms	Script application/x-javascript	2.23.65.88 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.23.65.88 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-23-65-88.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 25 Apr 2024 02:12:10 GMT Content-Encoding gzip Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4741 Expires Sat, 03 Aug 2024 02:12:10 GMT
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 438 B	164ms 121ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept * Referer https://www.securonix.com/ sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:10 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 80DFB1A05DF84522928E5A917D389918 Ref B: FRAEDGE1916 Ref C: 2024-04-25T02:12:10Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 access-control-allow-origin https://www.securonix.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYW4lCbTCLYg6HgJStd0Q==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-secu... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-secu... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D61924%26time%3D1714011130952%26li_adsId%3D124a6cd9-91ce-4e51-bb49-7cfd4349eeae%26... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-secu... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-sec...	0 264 B	156ms 109ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKXFYxELz8iKQAAAY8TBk4XFAUpzA8tC2oP43X1zvpv5EvPtjBCjsaSPkPAZlgbnEDDCkKjNmhFyoq4XVPrL9koInWd1w Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers date Thu, 25 Apr 2024 02:12:10 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: DE5262CD601E409085E69AFE0537F0B0 Ref B: FRAEDGE1219 Ref C: 2024-04-25T02:12:11Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAYW4lCjT/XtO7863C4DGQ== Redirect headers date Thu, 25 Apr 2024 02:12:10 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 859C8F459A9F4F6CB5D40B9E2E24C596 Ref B: FRAEDGE1916 Ref C: 2024-04-25T02:12:11Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1714011130952&li_adsId=124a6cd9-91ce-4e51-bb49-7cfd4349eeae&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKXFYxELz8iKQAAAY8TBk4XFAUpzA8tC2oP43X1zvpv5EvPtjBCjsaSPkPAZlgbnEDDCkKjNmhFyoq4XVPrL9koInWd1w x-li-proto http/2 content-length 0 x-li-uuid AAYW4lCg68HMmxC2xSL3aQ==
GET H2	204	27010718.js Show response bat.bing.com/p/action/	0 117 B	32ms 32ms	Script text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/27010718.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Thu, 25 Apr 2024 02:12:10 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 2F93235081534BBFA4B13F88E3DE0E2A Ref B: FRA31EDGE0119 Ref C: 2024-04-25T02:12:10Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 286 B	33ms 33ms	Image text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=27010718&tm=gtm002&Ver=2&mid=12a76006-22e2-4d75-938a-4e1b89e9619e&sid=3985d1e002a911efad45f148dd44fdf8&vid=39860aa002a911ef8041a930b711d1d9&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix&p=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&r=&lt=559&evt=pageLoad&sv=1&rn=630035 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 25 Apr 2024 02:12:10 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: FC7D1D34A5FB44D9B5391C6820E6194E Ref B: FRA31EDGE0119 Ref C: 2024-04-25T02:12:10Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	visitWebPage 179-djp-142.mktoresp.com/webevents/	2 B 318 B	591ms 98ms	Ping text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://179-djp-142.mktoresp.com/webevents/visitWebPage?_mchNc=1714011130983&_mchCn=&_mchId=179-DJP-142&_mchTk=_mch-securonix.com-1714011130983-57198&_mchHo=www.securonix.com&_mchPo=&_mchRu=%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 25 Apr 2024 02:12:11 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id 6910d262-274d-4cab-80c8-4070796a8674
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	96ms 96ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=ipv6&q=%7B%22address%22%3A%222a02%3A6ea0%3Ac71b%3A0%3A1011%3A591f%3Ad013%3A381a%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=11e2f684-8693-457d-8207-8c0888ffe688&v=1.1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:11 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:11 GMT
GET H2	200	VJKZ2AZ6BRDQFPNHOW6CAP Show response d.adroll.com/consent/check/	490 B 583 B	121ms 34ms	Script application/javascript	2a05:d018:cc3:fe05:48b3:63f8:3117:e0cc AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/VJKZ2AZ6BRDQFPNHOW6CAP?pv=74824934297.74672&arrfrr=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&_s=1280c931134efa48b1584085cfe84d61&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:cc3:fe05:48b3:63f8:3117:e0cc Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.22.1 / Resource Hash 2b794b595ab1161784d61fb187b7d438c0e02ca264f76ac7ef113a659167b4f4 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:11 GMT server nginx/1.22.1 content-length 490 content-type application/javascript
GET H2	200	details Show response epsilon-globalaccelerator.6sense.com/v3/company/	745 B 721 B	28ms 13ms	XHR application/json	13.248.142.121 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon-globalaccelerator.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.248.142.121 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash 4160094e8e7a55a3dd60c62de930a81375ddce09c11dc6d7b28332da6dbbdf14 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Token 45bc92abc111f3fccbf9c8779059ecfc1d69c9e6 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 X-6s-CustomID WebTag1.0 05b12115ad17914938bf7667643ca0d3 Referer https://www.securonix.com/ sec-ch-ua-platform "Win32" Response headers x-trace-id 4834508827383005014 date Thu, 25 Apr 2024 02:12:11 GMT content-encoding gzip server nginx vary Origin, Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://www.securonix.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 399
OPTIONS H2	200	details epsilon-globalaccelerator.6sense.com/v3/company/ Frame	0 0	35ms 11ms	Preflight	13.248.142.121 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon-globalaccelerator.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.248.142.121 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.securonix.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Thu, 25 Apr 2024 02:12:11 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a x-trace-id 7941279665991703870
GET H/1.1	200 OK	consent_tcfv2.js Show response s.adroll.com/j/	413 KB 83 KB	7ms 7ms	Script text/javascript	2600:9000:2644:7c00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/consent_tcfv2.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:7c00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 3ec093226dbb4c5f2767562378e80a955db377003a72f5ff70cd65040983090f Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers X-Amz-Version-Id E8Xqd_XzP1xGQPgJ2rRArNdUFnSvN3pa Content-Encoding gzip Via 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront) Date Thu, 25 Apr 2024 02:09:56 GMT Age 142 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Thu, 08 Feb 2024 21:46:10 GMT Server AmazonS3 Etag W/"e1dc09168683fa834f599c01bb66de29" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=300, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id Uo1bfQvBN3jrcZNvQklhGNmbLMUhbejzZzt5Tv9-t1EqPqt1Ih4Vqw==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	100ms 99ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=https%3A%2F%2Fepsilon-globalaccelerator.6sense.com&q=%7B%22name%22%3A%22https%3A%2F%2Fepsilon-globalaccelerator.6sense.com%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A893.3000030517578%2C%22duration%22%3A64.0999984741211%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A893.3000030517578%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A957.4000015258789%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22eu-central-1a%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=&d=1&v=1.1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:11 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:11 GMT
GET H/1.1	200 OK	nextroll-32x32.png s.adroll.com/i/favicon/	2 KB 2 KB	8ms 8ms	Image image/png	2600:9000:2644:7c00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.adroll.com/i/favicon/nextroll-32x32.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:7c00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers X-Amz-Version-Id eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0 Date Wed, 24 Apr 2024 06:31:32 GMT Via 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront) Age 70903 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 1615 Last-Modified Mon, 28 Jun 2021 18:19:21 GMT Server AmazonS3 Etag "403a0a7dcf2d617e7ea852bfb9d11945" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type image/png Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id Fob3ba4Fxe3GKktYroS3xSFbPJHxWKMG4E3JLRqKrofbWuAOmvcW-A==
GET H2	200	core js.driftt.com/ Frame 8ABE	0 0	326ms 307ms	Document text/html	18.245.86.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=476bc59b-a9f0-4eec-84ba-1a0df855b4a0&sessionStarted=1714011131.631&campaignRefreshToken=5b3f5b9b-6795-4c9b-8007-5d770105d4c4&hideController=false&pageLoadStartTime=1714011130274&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1714011300000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.14 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-14.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Thu, 25 Apr 2024 02:12:11 GMT etag W/"f4497bfb5a87b7c4365be2cac47f8d1a" last-modified Thu, 04 Apr 2024 19:46:21 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 b4f72de8ce5f3b4b4240eccfbd3d12a6.cloudfront.net (CloudFront) x-amz-cf-id pAEMySouD3sH3FwfnYABsrqrklzHNUdeN0TEIrJueZmIvVFKStj5iQ== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id ZBEiLR5jfh3iii3cnfTNRQsxvVBIMKla x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 14
GET H2	200	chat js.driftt.com/core/ Frame 4E50	0 0	310ms 293ms	Document text/html	18.245.86.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1714011130274 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1714011300000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.14 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-14.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Thu, 25 Apr 2024 02:12:11 GMT etag W/"f4497bfb5a87b7c4365be2cac47f8d1a" last-modified Thu, 04 Apr 2024 19:46:21 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 b4f72de8ce5f3b4b4240eccfbd3d12a6.cloudfront.net (CloudFront) x-amz-cf-id cjLF4cPqGmJHDq4Yd1B18USlvhgyxpu8WkTzDk669S32bGr8uGtA5g== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id ZBEiLR5jfh3iii3cnfTNRQsxvVBIMKla x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 13
GET H2	200	nr-rum-1.257.0.min.js Show response js-agent.newrelic.com/	50 KB 18 KB	31ms 6ms	Script application/javascript	2602:816:5001::39 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-rum-1.257.0.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2602:816:5001::39 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ac2185eaf27db9d83c2688a55c428a5f18bbe41d8f769c58f41f081b8b17834b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Origin https://www.securonix.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id hDZawLvU_7lPCCc8KE3sqLucpiUuFFEu content-encoding br via 1.1 varnish date Thu, 25 Apr 2024 02:12:11 GMT strict-transport-security max-age=300 x-amz-request-id ZBKPBC4EYJ9CVCQ2 x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 17464 x-amz-id-2 cOsGKYq7LsN5P2l6NjtrRga5Bc2t0B4D06cuL0NDRMxsUhL0o+K1w4qSyR+yq8rwkTTwf1BbdHykudExNwA8i6TtK+ZA4AYL x-served-by cache-fra-eddf8230057-FRA last-modified Fri, 19 Apr 2024 00:43:41 GMT server AmazonS3 etag "04045b88714f08119a0e2fcb74624f22" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 accept-ranges bytes x-cache-hits 131577
POST H/1.1	200	NRJS-e6ece394b0ed1b033c0 Show response bam.nr-data.net/1/	151 B 602 B	614ms 536ms	XHR text/plain	162.247.243.29 FASTLY
General Check archive.org Show headers Download Go to Full URL https://bam.nr-data.net/1/NRJS-e6ece394b0ed1b033c0?a=989077289&v=1.257.0&to=ZwNaNkBSWkAHVUZRCV5JeQFGWltdSUVbVgFcAxUAXlxT&rst=1501&ck=0&s=b8ea468948bf0ca2&ref=https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/&ap=1138&be=59&fe=1401&dc=499&at=S0RZQAhISU4%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1714011130199,%22n%22:0,%22f%22:0,%22dn%22:11,%22dne%22:11,%22c%22:11,%22s%22:16,%22ce%22:30,%22rq%22:30,%22rp%22:59,%22rpe%22:75,%22di%22:557,%22ds%22:557,%22de%22:558,%22dc%22:1428,%22l%22:1452,%22le%22:1460%7D,%22navigation%22:%7B%7D%7D&fp=447&fcp=447 Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-rum-1.257.0.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.29 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash af64f318f5d1e691c1437d3caa39d375cab4d8d8aca0f127ccb9cd9939226a3c Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 content-type text/plain Response headers date Thu, 25 Apr 2024 02:12:12 GMT access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS content-type text/plain access-control-allow-origin https://www.securonix.com access-control-expose-headers Date access-control-allow-credentials true cross-origin-resource-policy cross-origin Connection keep-alive timing-allow-origin https://www.securonix.com Content-Length 151 x-served-by cache-fra-eddf8230047-FRA
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	100ms 100ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A10%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=11e2f684-8693-457d-8207-8c0888ffe688&v=1.1.16 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:12 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:12 GMT
GET H2	403	cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png www.securonix.com/wp-content/uploads/2021/12/	17 KB 9 KB	15ms 14ms	Other text/html	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c210fca0f9b50d55e4571e3353e2754420d67197d652d01ebb3c0ddee6e097f1 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:12 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin cf-chl-out fMOwbMF6VC6+6TpTxFKbmFOItrA6QAKA8p/s+KHi/iboWPP35wo2jegs5j44Ra2JfbtycqVkCwHc6Q2Xj8to0xn1XPnL2l6eufW0BZlUs4XQ1HeMCq/w8bZLE187GWdpaIaxhYTwShvC/BaXeoYrnQ==$PjKdzzHkc0TNAbJEnvyGWg== referrer-policy same-origin accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-opener-policy same-origin cf-mitigated challenge server cloudflare x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gcfLoXWu5CLaxY%2F%2Fq6A2WWhEeXreCn%2FiETe2jj%2FPaiimJkBazoOr8JBWxLVB57rBPxgvg9nyYhJ2Qz3bnU2%2BBw8LC7lhzvwwFYptDxHt2TaPxOPioK%2FkiPgo3G3PwF4cAGTXJijabuo%2BgzD8yA%2Fz"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 879ace87ef681e6a-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET H2	403	cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-192x192.png www.securonix.com/wp-content/uploads/2021/12/	17 KB 8 KB	15ms 14ms	Other text/html	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-192x192.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c93788c26e849a8ac7a57f93ee1b36a77f7bff8242c679a42301568035d2ca91 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:12 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin cf-chl-out h2meXistmY/ti5z0LGxqTdbJ0he+fGCiQeZi4gI7V8jPSVpsGE/wtuE4dl5om3qAKSOzGb6YaD4cjZ36uCpkuSLlsb2IQSMFCmyJCGDamlGazdyWK/VTyyAAF8BY5tflrPmZV9ucShr9ak1Ku49KMw==$tvYuzwO6akOvs6L1D8A9nw== referrer-policy same-origin accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-opener-policy same-origin cf-mitigated challenge server cloudflare x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2amY%2BQjEJxZDQmCDEPyYyGDrZQI7yzM14TMFPOwQNI7PhoVkTx5BrLluR7lFTwc2TnWY1V2GFLdIw93oZwr%2BCLFArfkWND3Nc8ZGxKhYLd5nLcEy0Y4hs6DAgbT%2BBD2Ro2Eu9%2BkxpGLWGPuED%2B%2BZ"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 879ace880f7f1e6a-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET H2	403	Featured_Thumbnail_477X364.jpg www.securonix.com/wp-content/uploads/2023/04/	17 KB 17 KB	16ms 15ms	Image text/html	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/04/Featured_Thumbnail_477X364.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f93585541b79e04327457be09c62bbf981a13957e59bf6d9a89d5150bfc1d088 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:12 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin cf-chl-out KWlBD8vcTqhioXjojD0VM5lZc1udw5VOA3gpcW5OpVLaQl/kFKetkcers0tO0bwD2F/kgleciUuDO1R0tKQCEoQEtfzged70Uw+VZODAXeaMtWrFL6bzec+Lnwdu1jw/0VC8ZzDKMaHfD5dJAMLllw==$OBvkkcHsJABlHXJr9Qwh8A== referrer-policy same-origin accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-opener-policy same-origin cf-mitigated challenge server cloudflare x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aXjQMvRMeAMLGEICOUIfiUPuqLyR1QlWEY17mhtrmO9QfB1tDs2hooJN1FD%2FIObUavqmIBfWwQtD0Eia1r41c6rRDDQ423oxdrIsX1lSonGXded%2BucQINN1VWMBhajn1zHGsHUPMgZc2bNHongjv"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 879ace8b28f01e6a-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET H2	403	gartner_innovationInsightReport_21_menuImg.jpg www.securonix.com/wp-content/uploads/2021/12/	17 KB 17 KB	15ms 14ms	Image text/html	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2021/12/gartner_innovationInsightReport_21_menuImg.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e01d99c281b73c14b598d6b1e612af61988184ed4276f815938677fcbd5db560 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 25 Apr 2024 02:12:12 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin cf-chl-out MtbIQXG5wGjlbP+jiN1t19coMcA3PzTd1bk3hVxZWpsCR/i/gHVFbAC445iF9LWmOc0o1Xya9WtHdmpfxwPi/C2X6wNWQmkA08nsfC/gfeKXkPhWaXChpM3abAzizeXKckEud/nxPBvZDyDi8g3QMQ==$iYA93Ai//e5u6MQe73WzSA== referrer-policy same-origin accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-opener-policy same-origin cf-mitigated challenge server cloudflare x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zpPhudfM5mp9c8MNxkl3sMzDyi%2FIjxjd9YmefTBiHAPpwvPvdFQPr3B9xXK52%2BtvbNoqAriffnIk8R2oeCjyly1Ya96YbgwkOvBj%2BNyJoCByde3wUwgmL0SOEiJv2vI9LeyvKVadFKnG6thobZD9"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 879ace8b28f11e6a-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	100ms 100ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A11%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=11e2f684-8693-457d-8207-8c0888ffe688&v=1.1.16 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:13 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:13 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	102ms 100ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A12%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=11e2f684-8693-457d-8207-8c0888ffe688&v=1.1.16 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:14 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:14 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	101ms 100ms	Image image/gif	2.17.22.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ea8305b5-ff4c-48af-8a98-558b9d7d542b&session=f4e94aad-d0ae-4604-8cbc-ac2623e7961f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2025%20Apr%202024%2002%3A12%3A13%20GMT%22%2C%22timeSpent%22%3A%221007%22%2C%22totalTimeSpent%22%3A%224012%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=11e2f684-8693-457d-8207-8c0888ffe688&v=1.1.16 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.22.179 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-22-179.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.securonix.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 25 Apr 2024 02:12:15 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 25 Apr 2024 02:12:15 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

lltrck.com

URL

https://lltrck.com/scripts/lt-v3.js?llid=23883