www.securonix.com Open in urlscan Pro
2606:4700:3108::ac42:2b19 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Submission: On April 24 via api (April 24th 2024, 2:17:19 pm UTC) from US — Scanned from DE

Summary HTTP 101 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 30 IPs in 6 countries across 23 domains to perform 101 HTTP transactions. The main IP is 2606:4700:3108::ac42:2b19, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.securonix.com.
TLS certificate: Issued by E1 on April 16th 2024. Valid for: 3 months.

This is the only time www.securonix.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
40	2606:4700:310... 2606:4700:3108::ac42:2b19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a02:26f0:350... 2a02:26f0:3500:16::215:1485	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:81d::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6816:47c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	23.57.166.202 23.57.166.202	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
8	172.67.39.148 172.67.39.148	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:310... 2606:4700:3108::ac42:283b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	92.123.26.233 92.123.26.233	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.16.87.20 104.16.87.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:1484	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 6	2600:9000:264... 2600:9000:2644:1000:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2606:4700::68... 2606:4700::6811:f6cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.86.87 18.245.86.87	16509 (AMAZON-02) (AMAZON-02)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c07::9d	15169 (GOOGLE) (GOOGLE)
1	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
2 3	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a05:d018:cc3... 2a05:d018:cc3:fe04:48dc:ec6b:8288:f981	16509 (AMAZON-02) (AMAZON-02)
2	13.248.142.121 13.248.142.121	16509 (AMAZON-02) (AMAZON-02)
2	18.245.86.14 18.245.86.14	16509 (AMAZON-02) (AMAZON-02)
1	2602:816:5001... 2602:816:5001::39	54113 (FASTLY) (FASTLY)
1	162.247.243.29 162.247.243.29	54113 (FASTLY) (FASTLY)
101	30

40 2606:4700:3108::ac42:2b19 (United States)

ASN13335 (CLOUDFLARENET, US)

www.securonix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:3500:16::215:1485 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:47c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.74.206 (None, )

ASN13335 (CLOUDFLARENET, US)

pages.securonix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.57.166.202 (Dublin, Ireland)

ASN16625 (AKAMAI-AS, US)
PTR: a23-57-166-202.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.67.39.148 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3108::ac42:283b (United States)

ASN13335 (CLOUDFLARENET, US)

embed.formhq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 92.123.26.233 (London, United Kingdom)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a92-123-26-233.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.87.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:1484 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2644:1000:6:9280:1080:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:f6cb (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-87.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

179-djp-142.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:22::14 (United States) 2 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:cc3:fe04:48dc:ec6b:8288:f981 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.142.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.245.86.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-14.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:816:5001::39 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.243.29 (United States)

ASN54113 (FASTLY, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	securonix.com www.securonix.com pages.securonix.com	1 MB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 5885 c.6sc.co — Cisco Umbrella Rank: 9001 ipv6.6sc.co — Cisco Umbrella Rank: 6019 b.6sc.co — Cisco Umbrella Rank: 3922	20 KB
9	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 3731	33 KB
7	adroll.com 1 redirects s.adroll.com — Cisco Umbrella Rank: 3422 d.adroll.com — Cisco Umbrella Rank: 1607	118 KB
6	typekit.net use.typekit.net — Cisco Umbrella Rank: 463 p.typekit.net — Cisco Umbrella Rank: 574	92 KB
4	linkedin.com 2 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 328 px4.ads.linkedin.com — Cisco Umbrella Rank: 6223	2 KB
3	driftt.com js.driftt.com — Cisco Umbrella Rank: 5838	62 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 337	14 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	273 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9083	709 B
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 744	3 KB
2	formhq.net embed.formhq.net — Cisco Umbrella Rank: 160377	4 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3820	7 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 242	602 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 594	18 KB
1	google.de www.google.de — Cisco Umbrella Rank: 7278	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 84	256 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2941	256 B
1	mktoresp.com 179-djp-142.mktoresp.com	318 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 781	17 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 320	3 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 363	31 KB
0	lltrck.com Failed lltrck.com Failed
101	23

	Domain	Requested by
40	www.securonix.com	www.securonix.com
9	static.addtoany.com	www.securonix.com static.addtoany.com
7	b.6sc.co	www.securonix.com
6	s.adroll.com	1 redirects www.googletagmanager.com www.securonix.com s.adroll.com
5	use.typekit.net	www.securonix.com use.typekit.net
3	px.ads.linkedin.com	2 redirects snap.licdn.com
3	js.driftt.com	www.securonix.com js.driftt.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.securonix.com
3	www.googletagmanager.com	www.securonix.com www.googletagmanager.com
2	epsilon.6sense.com	j.6sc.co
2	unpkg.com	1 redirects www.securonix.com
2	embed.formhq.net	www.googletagmanager.com embed.formhq.net
2	munchkin.marketo.net	www.securonix.com munchkin.marketo.net
1	bam.nr-data.net	js-agent.newrelic.com
1	js-agent.newrelic.com	www.securonix.com
1	d.adroll.com	s.adroll.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	px4.ads.linkedin.com	www.securonix.com
1	www.google.de	www.securonix.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	179-djp-142.mktoresp.com	munchkin.marketo.net
1	snap.licdn.com	www.googletagmanager.com
1	cdn.jsdelivr.net	www.securonix.com
1	j.6sc.co	www.securonix.com
1	p.typekit.net	use.typekit.net
1	pages.securonix.com	www.securonix.com
1	ajax.googleapis.com	www.securonix.com
0	lltrck.com Failed	www.securonix.com
101	30

This site contains links to these domains. Also see Links.

Domain
securonix.com
securonix.force.com
www.addtoany.com
threatpost.com
github.com
blog.phylum.io
lipsum.com
www.trendmicro.com
www.linkedin.com
www.helpnetsecurity.com
in.linkedin.com
www.instagram.com
twitter.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
securonix.com E1	`2024-04-16` - `2024-07-15`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
static.addtoany.com E1	`2024-04-23` - `2024-07-22`	3 months	crt.sh
pages.securonix.com Cloudflare Inc ECC CA-3	`2024-03-03` - `2024-12-31`	10 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
formhq.net E1	`2024-03-01` - `2024-05-30`	3 months	crt.sh
6sc.co R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 05	`2024-04-24` - `2024-06-27`	2 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
s.adroll.com Amazon RSA 2048 M01	`2023-06-03` - `2024-07-01`	a year	crt.sh
drift.com Amazon RSA 2048 M02	`2023-08-15` - `2024-09-11`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.google.de GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
d.adroll.com Amazon RSA 2048 M01	`2023-10-09` - `2024-11-07`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-03-31` - `2025-04-29`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-21` - `2025-04-22`	a year	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Frame ID: 9875621F049D6DF3F99902BB092E1D71
Requests: 98 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: BBEDB023B1AFC7085A72F5797E801338
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=fc05be39-de21-4ddc-ad01-0b2ea514ef57&sessionStarted=1713968235.667&campaignRefreshToken=ae398331-2a9f-4d16-bf67-5c568cc0ac1d&hideController=false&pageLoadStartTime=1713968233841&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F
Frame ID: 74F4FC68B5D7B593B356828681893E9A
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1713968233841
Frame ID: 191FA6E2C265A53FD2B151920DA69CA7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover - Securonix

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

101
Requests

95 %
HTTPS

59 %
IPv6

23
Domains

30
Subdomains

30
IPs

6
Countries

1927 kB
Transfer

4461 kB
Size

20
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://securonix.com/resources/
Title: Resources by Topic

Search URL Search Domain Scan URL

URL: https://securonix.com/partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://securonix.com/partners/securonix-fusion/
Title: Technology Alliance

Search URL Search Domain Scan URL

URL: https://securonix.force.com//
Title: Partner Portal Login

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&title=Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover
Title: Teilen

Search URL Search Domain Scan URL

URL: https://threatpost.com/sload-spying-payload-delivery-bits/151120/
Title: SLoader

Search URL Search Domain Scan URL

URL: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-04-15-IOC-for-Contact-Forms-campaign-SSLoad-activity.txt
Title: phishing email campaigns

Search URL Search Domain Scan URL

URL: https://github.com/executemalware/Malware-IOCs/blob/main/2024-04-17%20SSLoad%20IOCs
Title: kicks off the code execution

Search URL Search Domain Scan URL

URL: https://blog.phylum.io/detecting-obfuscated-malicious-code/
Title: standard text file

Search URL Search Domain Scan URL

URL: https://lipsum.com/
Title: Lorem ipsum

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/es/security/news/cybercrime-and-digital-threats/group-behind-trickbot-spreads-fileless-bazarbackdoor
Title: TrickBot malware gang

Search URL Search Domain Scan URL

URL: https://github.com/xx0hcd/Malleable-C2-Profiles/blob/master/template.profile
Title: indicator of compromise

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/pulse/phishing-still-1-attack-vector-huge-144-malicious-url-spike-knowbe4-copee
Title: #1 attack vector

Search URL Search Domain Scan URL

URL: https://www.helpnetsecurity.com/2024/03/05/steals-ntlm-hashes-email/
Title: https://www.helpnetsecurity.com/2024/03/05/steals-ntlm-hashes-email/

Search URL Search Domain Scan URL

URL: https://in.linkedin.com/company/securonix

Search URL Search Domain Scan URL

URL: https://www.instagram.com/securonix/

Search URL Search Domain Scan URL

URL: https://twitter.com/Securonix

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Securonix/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@securonix

Search URL Search Domain Scan URL

URL: https://securonix.com/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 59

https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
https://unpkg.com/web-vitals@3.5.2/dist/web-vitals.iife.js

Request Chain 73

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true&e_ipv6=AQKs5Tuf_QCXYgAAAY8Qd8MHBOQsGONwim5kADWC6lCoP_4o9NlD0stCKruT50uo86gkU8c

Request Chain 77

https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

101 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ 173 KB
41 KB 181ms
78ms Document
text/html 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3608f6b7fb9eb1cd747edb1f4f738b4e09220ea10ecebc5e47c917a6d2feaea1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 1671
cache-control: public, max-age=31536000
cf-apo-via: tcache
cf-cache-status: HIT
cf-edge-cache: cache,platform=wordpress
cf-ray: 8796b73519eb926d-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 14:17:13 GMT
last-modified: Wed, 24 Apr 2024 12:50:37 GMT
link: <https://www.securonix.com/wp-json/>; rel="https://api.w.org/", <https://www.securonix.com/wp-json/wp/v2/blog/25160>; rel="alternate"; type="application/json", <https://www.securonix.com/?p=25160>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zniNQeqWq4sP%2FSn%2FaiQV%2FiNr9wLN9yis58h3NlWTXKZWgmD%2FazXI8p0ZFIYEA4LKO0VLREamqjxvPGX7LR%2F0vLOfwtF%2Fo4qR1UE9J0r1a%2Bi2YfGg%2BKxLDMaa4PnSswzidRmKe%2FguhlItwXrtlHme"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31622400
vary: Accept-Encoding, Cookie, Cookie
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-pantheon-styx-hostname: styx-fe2-a-7b6c595dc8-hnjrt
x-served-by: cache-chi-kigq8000149-CHI, cache-ams21072-AMS
x-styx-req-id: 3eb13688-0239-11ef-bb4c-ae963a2550db
x-timer: S1713963036.939242,VS0,VE1883
x-xss-protection: 1; mode=block

GET
H2 200 pjm0fus.css
use.typekit.net/ 28 KB
3 KB 339ms
206ms Stylesheet
text/css 2a02:26f0:3500:16::215:1485
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/pjm0fus.css

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1485 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

32526fdcae3037b6c2d64e0728c146d0c6ba44bb3b663af970f05feab4393b15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Wed, 24 Apr 2024 14:17:14 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2381

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 126ms
39ms Script
text/javascript 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 23 Apr 2024 18:12:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72280
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Apr 2025 18:12:33 GMT

GET
H2 200 styles.css
www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/ 57 KB
7 KB 55ms
53ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.6

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af770f5afec3e9f10196ea60476a44dde4d80010e680500685b578fee468c8c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
cf-polished: origSize=59240
content-encoding: br
x-cache: HIT, HIT
x-cache-hits: 0, 4
x-served-by: cache-chi-kigq8000178-CHI, cache-ams21059-AMS
cf-bgj: minify
last-modified: Sat, 13 Apr 2024 22:49:35 GMT
server: cloudflare
x-timer: S1713821308.013081,VS0,VE2
etag: W/"661b0bff-e768"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I7Up%2BtE4p3442CNVu9WsBu3NjJ7D47Vmo6p000lpJuv1Y%2FsVe%2BYr9pp9hGxLVTCFVJU%2Bi58N6%2BAzxhvb%2FwFA%2BxxRUCYMsjLe0iEO9GDWu1U1pN%2FV%2Bw5w5jSvq2%2FyN5DOFWpO0225gwNGrhdXJk36"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86eec177-fa6d-11ee-8289-566fcc2daecf
cache-control: max-age=31622400
cf-ray: 8796b735bad7926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-d655f

GET
H2 200 wpcdt-public.css
www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/ 680 B
808 B 58ms
56ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/wpcdt-public.css?ver=2.5

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

175eab7bef961e3d69c7c97f5371d532f30be4547670ba55578ed1af53d3114d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
cf-polished: origSize=822
content-encoding: br
x-cache: HIT, HIT
x-cache-hits: 0, 4
x-served-by: cache-chi-kigq8000137-CHI, cache-ams21066-AMS
cf-bgj: minify
last-modified: Sat, 13 Apr 2024 23:49:16 GMT
server: cloudflare
x-timer: S1713821308.021353,VS0,VE3
etag: W/"661b19fc-336"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2BP1CBElmsXEEIzN4oDNYn%2FpTXf%2FgIWe2LaTRyhTjAjLYqCZfdrrKWtFEP9XSuoYqqTeFshG3RSYiH97Rang2WwfahFwcVfY57hTCTTucYNP%2FyyC46QPLqaVsCGWSbwEf1%2FqQj%2Bb04Yy7uyZVPy%2B"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86ef542f-fa6d-11ee-a486-7aaebfcc1a9f
cache-control: max-age=31622400
cf-ray: 8796b735badb926d-FRA
x-pantheon-styx-hostname: styx-fe2-a-57d8d64c7d-96n5x

GET
H2 200 jquery.powertip.min.css
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/ 2 KB
856 B 57ms
55ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/jquery.powertip.min.css?ver=1.2.0

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-a-57d8d64c7d-d4c5l
x-served-by: cache-chi-kigq8000120-CHI, cache-ams21024-AMS
last-modified: Sat, 13 Apr 2024 07:30:43 GMT
server: cloudflare
x-timer: S1713821308.015238,VS0,VE2
etag: W/"661a34a3-70d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Lx68xJVy%2F1p%2ByU8B5v%2FxqUHJspiUNp6ADl%2FyE0iSO3zm1EAgito4%2BZIfo2dWrdQKwnnBvAvDYdtr2%2FkWPjrW8aL7BCMV0lWTYGHRtzFbk3v6l0ADrh3nIrlT3uW7qEDSvBcZvUXd4T68Y5yClOg"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86eecdf9-fa6d-11ee-9baf-2ab61ac3db7f
cache-control: max-age=31622400
cf-ray: 8796b735badd926d-FRA
x-cache-hits: 0, 4

GET
H2 200 maps_points.css
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/ 5 KB
2 KB 60ms
58ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/maps_points.css?ver=1.2.2

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e2d296664123aed1106464a611ef20234a6eed68d82ed5b1afd66660b185c59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
cf-polished: origSize=6896
content-encoding: br
x-cache: HIT, HIT
x-cache-hits: 0, 4
x-served-by: cache-chi-klot8100052-CHI, cache-ams21080-AMS
cf-bgj: minify
last-modified: Sat, 13 Apr 2024 21:41:40 GMT
server: cloudflare
x-timer: S1713821308.018971,VS0,VE2
etag: W/"661afc14-1af0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yh%2BH3PL0%2BCMeklYNM5Dm%2FnrplP%2BCgrxsMY%2BX6%2B%2FWycRTMyoOBrhD9y6pj8%2B3Y3r6ZC3vW5kBhzTb4%2FeTbnLewXXmx2sE6ggt%2Foma4Bv5RSwUNvDlyGgTrlBE%2BqdCTQyPyCxskrzaYBr6cXfquQ2R"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86f7ab94-fa6d-11ee-8fec-daca86ef21ae
cache-control: max-age=31622400
cf-ray: 8796b735bade926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-b8pvd

GET
H2 200 style.min.css
www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/ 258 B
528 B 56ms
54ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b9257e3e9c959214ddfab833a69a021ae6557403efe76afcbee259621175274

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-7pk4l
x-served-by: cache-chi-klot8100055-CHI, cache-ams21043-AMS
last-modified: Sat, 13 Apr 2024 22:49:35 GMT
server: cloudflare
x-timer: S1713821308.022747,VS0,VE3
etag: W/"661b0bff-102"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qKwPt2sx9EJvGmEY7rG2qxJ5ZM6IEqrBoLZXOenb9qHSmB92UuscqOi4m9xIecfdmBo9W9IuO%2F%2FgLABPXMQtcZwB%2FWugkNxWaRbwWVp3r%2BAoZYFOW1NIxfDRwRkhflJXQKzDT0GVnGklqQ9Ju1rA"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86f79474-fa6d-11ee-810e-3e9b3257ad3f
cache-control: max-age=31622400
cf-ray: 8796b735badf926d-FRA
x-cache-hits: 0, 4

GET
H2 200 style.css
www.securonix.com/wp-content/themes/securonix/assets/css/ 443 KB
70 KB 105ms
103ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1713887471

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6eb4cf02a13fd5ba1886458ccf1596b2fcf5c63a26c437b61e4ee58f5e3f7b4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 16:01:25 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-polished: origSize=457588
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-served-by: cache-chi-klot8100174-CHI, cache-ams21040-AMS
cf-bgj: minify
last-modified: Tue, 23 Apr 2024 03:46:53 GMT
server: cloudflare
x-timer: S1713888086.890566,VS0,VE161
etag: W/"66272f2d-6fb74"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GEe0MAMZ8QP1bHF6%2F1iMtOYymxk3C7oVkgE5E4UrPlom1qnc8%2FurFqd2fNX4qwVGQhbycRWBezPsLhYzLvVcxdOUwAQrJYmOlYqKl6cYw5Q7wLLN%2FQOLJxuSs%2BKPI9F%2BRWanWg6R53ElAYSFwdNw"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: bcfbc16d-018a-11ef-967f-1e20ba6ca139
cache-control: max-age=31622400
cf-ray: 8796b735bae1926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-76f6c9d98-zb7md

GET
H2 200 stylesheet.css
www.securonix.com/wp-content/themes/securonix/assets/css/fonts/ 2 KB
802 B 81ms
80ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/css/fonts/stylesheet.css?ver=1713887471

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbb6162a3febf0d96b3372dd4f325d2ecd9b9c4e2c6d23e2c2b4eeeb3d7ccdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 16:01:25 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-polished: origSize=2058
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-served-by: cache-chi-klot8100032-CHI, cache-ams21020-AMS
cf-bgj: minify
last-modified: Tue, 23 Apr 2024 03:32:49 GMT
server: cloudflare
x-timer: S1713888086.893209,VS0,VE126
etag: W/"66272be1-80a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q4Ai5s4f868l%2BlnLyY9%2FjZV4PukkOiRZGSlUVKxlGutqwgKJJE5OZfa2lPF2XIS%2FbQrRUUr0jDZUQMAKf%2FTPRH1dIy5ESgQxYNP9NbNXMNMbPxd2PJnrgz%2Fp9I4NABu2GXe3f0LuABp7Av5MmA37"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: bcfc4fd3-018a-11ef-811f-e627ebaa874e
cache-control: max-age=31622400
cf-ray: 8796b735bae2926d-FRA
x-pantheon-styx-hostname: styx-fe2-a-7d9c76749d-7vdxr

GET
H2 200 default.css
www.securonix.com/wp-content/plugins/tablepress/css/build/ 6 KB
3 KB 59ms
58ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/tablepress/css/build/default.css?ver=2.1.7

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9bc19ce27e7fe54728be0d4489cf683005fd6f522bbf6391a681d7d2d8d3f190

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
cf-polished: origSize=6091
content-encoding: br
x-cache: HIT, HIT
x-cache-hits: 0, 4
x-served-by: cache-chi-klot8100062-CHI, cache-ams21055-AMS
cf-bgj: minify
last-modified: Sat, 13 Apr 2024 21:41:41 GMT
server: cloudflare
x-timer: S1713821308.022871,VS0,VE2
etag: W/"661afc15-17cb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F0LJpP8ayB9tDd1H86ps2ltf74ty%2BXv2DDji%2BmMcs5zF0O4sQ%2BsPQlikEmri3KzlYdAfKLRxNW318eepez7PGBGrPgfe1%2Fw%2F1Kz1vcl07NX9J9GxM5kRYwGZE7ZKhlBTjUe5pAHZ2oJmhbWvv5Li"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86f70640-fa6d-11ee-94a7-1a3b08b151cb
cache-control: max-age=31622400
cf-ray: 8796b735bae4926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-bzdln

GET
H2 200 tablepress-responsive.min.css
www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/ 9 KB
2 KB 57ms
56ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-rm6p6
x-served-by: cache-chi-klot8100134-CHI, cache-ams21079-AMS
last-modified: Sat, 13 Apr 2024 23:49:17 GMT
server: cloudflare
x-timer: S1713821308.022871,VS0,VE2
etag: W/"661b19fd-22aa"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1wjgx5A9e7pPviTvVBCqX2kKx9nlTcLJrggSuehq1Te6mGNmx7xfrSDBvE73K6ZlrYb5QFCbXUugGl4lWQSLDgZ08GFwyNMsBK7JnbUL%2BbS9VIg88boTbYmcindHTsQVFHaIix0eBM9lY0lTh0VF"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86f74c07-fa6d-11ee-93a3-66529c49ef00
cache-control: max-age=31622400
cf-ray: 8796b735bae5926d-FRA
x-cache-hits: 0, 4

GET
H2 200 addtoany.min.css
www.securonix.com/wp-content/plugins/add-to-any/ 2 KB
1 KB 58ms
57ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-a-57d8d64c7d-vwdbt
x-served-by: cache-chi-klot8100052-CHI, cache-ams21054-AMS
last-modified: Sat, 13 Apr 2024 07:30:41 GMT
server: cloudflare
x-timer: S1713821308.024454,VS0,VE3
etag: W/"661a34a1-644"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GPS3I7Dr%2Fs%2BdbMPVW9LHjzuaW%2FOGSxy4OM%2FgvFeHftY2cfd%2Fj2dV5byNby0frvvEALtU%2BOuTILjqhd5L00X%2Bk8y4hN0Rsl6711X2Bw9V1s0Ut7JSUXsYpwLbhZ3K9t%2F1IJ7NknJekJgRNf8yQbMd"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86f5e7ea-fa6d-11ee-b983-a608f412765a
cache-control: max-age=31622400
cf-ray: 8796b735bae7926d-FRA
x-cache-hits: 0, 4

GET
H2 200 ubermenu.min.css
www.securonix.com/wp-content/plugins/ubermenu/pro/assets/css/ 66 KB
10 KB 100ms
99ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/ubermenu/pro/assets/css/ubermenu.min.css?ver=3.7.4

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7ba7e664816f88dde2f3f9b789e427087a5deb8986f708dd02bcfe1c0d8ff55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Sun, 13 Apr 2025 22:15:33 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: MISS, HIT
x-pantheon-styx-hostname: styx-fe2-a-57d8d64c7d-vwdbt
x-served-by: cache-chi-kigq8000138-CHI, cache-ams21044-AMS
last-modified: Fri, 12 Apr 2024 07:16:06 GMT
server: cloudflare
x-timer: S1713821308.023119,VS0,VE3
etag: W/"6618dfb6-1062c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vvAWngCO3BVQdQMpz7RDZAaFy%2F4qp7W8rsNHftbjibnvNB2B0ZdPM7hbsUoBYBJOKwJGmNlV9TrPad%2FV5RPKA7RrFd4lyOv5DAtuu%2BW6PV9%2BDZlUJj8kIBcQzYdll2qSj0ft0RO8YpOspluRbGEi"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 2df85796-f91a-11ee-b983-a608f412765a
cache-control: max-age=31622400
cf-ray: 8796b735fb26926d-FRA
x-cache-hits: 0, 4

GET
H2 200 all.min.css
www.securonix.com/wp-content/plugins/ubermenu/assets/fontawesome/css/ 57 KB
13 KB 92ms
91ms Stylesheet
text/css 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/ubermenu/assets/fontawesome/css/all.min.css?ver=6.4.3

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-nrk6l
x-served-by: cache-chi-klot8100168-CHI, cache-ams21066-AMS
last-modified: Sat, 13 Apr 2024 21:41:41 GMT
server: cloudflare
x-timer: S1713821308.023619,VS0,VE2
etag: W/"661afc15-e4d2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C6babFAhxUkEDaAAxaWekwMqXM5%2FztNPDbBDwW7by0Q76%2B2RbI%2FOUPgzoLNTYaZGpB5%2BKdI9ZIhRnGhQS5BAzELgDRO%2B9Qe0hI4zY6JF%2BCwmyKHjczFZHzi4Y4Fy6DkJ4iBQfra4uCTRhdQvHcwC"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-styx-req-id: 86f62558-fa6d-11ee-91c8-7af237c31095
cache-control: max-age=31622400
cf-ray: 8796b735fb28926d-FRA
x-cache-hits: 0, 4

GET
H2 200 language-cookie.js Show response
www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/ 241 B
666 B 91ms
90ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.6.6

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d01e29303e11404333dd1293ed958ee09b41203f03b4083a48cc33a66700ffd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
cf-polished: origSize=271
content-encoding: br
x-cache: MISS, HIT
x-cache-hits: 0, 4
x-served-by: cache-chi-klot8100114-CHI, cache-ams21029-AMS
cf-bgj: minify
last-modified: Sat, 13 Apr 2024 22:49:35 GMT
server: cloudflare
x-timer: S1713821311.635644,VS0,VE2
etag: W/"661b0bff-10f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IQNUJsSmY0IAMZEIpk0e5kXK1rnz%2BU1l180pajx1mnwAHt%2BKRQBYiEWz8NaQew9zJkCuDoCHTAwetYX98MT8O8FC%2Fuc%2BFdSYke7yz18SCOa2rs7EVz7%2FpGM%2By4okvQZfVRJygunPUCjFHw4%2BLYYX"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 86f86693-fa6d-11ee-810e-3e9b3257ad3f
cache-control: max-age=31622400
cf-ray: 8796b735fb2a926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-7pk4l

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 144ms
55ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e0cc78c402cbc02fdfd41cd77c5fd6ffbd8066cc07935ea8eb5f3fcc59744a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25386
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"e346c2841e4abbb66ee259e9540abb61"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PgVcuyexPCXFpRW5kF9OnydB12y1CM29EC3VMes935eceYTKl%2FlgYJBwewm9YiDDUJgSk37LhckWW%2BflNXx8FVShCTMmLXh4y1M4BxvSgZebdWL9D279Jcc1NIv6TSu0beeS90fG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 8796b7397f1f8f3b-FRA

GET
H2 200 jquery.min.js Show response
www.securonix.com/wp-includes/js/jquery/ 86 KB
31 KB 101ms
100ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-a-57d8d64c7d-9ngfg
x-served-by: cache-chi-klot8100155-CHI, cache-ams21060-AMS
last-modified: Sat, 13 Apr 2024 22:49:37 GMT
server: cloudflare
x-timer: S1713821311.632141,VS0,VE2
etag: W/"661b0c01-15601"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fh3%2BntShxLZUOAxOyMFWR2rKYDjR%2F7r8OaM4ebkHvvuEQEemNG4M%2Fz%2Bgu0DX9KGGU9jcfSWJXACtIsSvX%2BJ9FDia2GJrw4%2FTf03S%2FGwY%2FuF2nxcIp%2FZuStxG7%2BbGrtuekfPNg381JP1MR6Z5kNUs"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 86f71d13-fa6d-11ee-93e3-aafe187c636f
cache-control: max-age=31622400
cf-ray: 8796b735fb2b926d-FRA
x-cache-hits: 0, 4

GET
H2 200 jquery-migrate.min.js Show response
www.securonix.com/wp-includes/js/jquery/ 13 KB
5 KB 93ms
93ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:41 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-bzdln
x-served-by: cache-chi-kigq8000086-CHI, cache-ams21072-AMS
last-modified: Sat, 13 Apr 2024 21:41:42 GMT
server: cloudflare
x-timer: S1713821311.629154,VS0,VE3
etag: W/"661afc16-3509"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mHAZ2HSYAerUw5jbMeYc48XWiacZZor%2BZxnOh%2Bixu9oYhyGR5BubfWpfShBJ%2BjPtkfT79u6DNb5VVeni8TpdjSfFLW1kFYh70ik3%2B5FtFwbhgvJhjGgmTvmJcrZtrK8DVrWl4q0WPRjh3r%2FSuhKk"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 86f8888c-fa6d-11ee-94a7-1a3b08b151cb
cache-control: max-age=31622400
cf-ray: 8796b735fb2c926d-FRA
x-cache-hits: 0, 7

GET
H2 200 addtoany.min.js Show response
www.securonix.com/wp-content/plugins/add-to-any/ 129 B
540 B 104ms
102ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:42 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136129
content-encoding: br
x-cache: MISS, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-hbk2r
x-served-by: cache-chi-klot8100064-CHI, cache-ams21052-AMS
last-modified: Sat, 13 Apr 2024 23:49:15 GMT
server: cloudflare
x-timer: S1713821308.276956,VS0,VE2
etag: W/"661b19fb-81"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=10jmvLFTIj6CgImPMlWZl9KEmK95e0sPVDGhRVAKwMTegkLiNeAxp7mm8H6RHZ3r6qxUYLGbOonrqWgjIclzn98hosXzH7rGOVWvx%2F1ynruv0nmLD3p7%2F35L1xjNtFnXhdguVv4UvAQPr6qJJVFu"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 873ef1aa-fa6d-11ee-b096-6ee28b929e97
cache-control: max-age=31622400
cf-ray: 8796b7393f1b926d-FRA
x-cache-hits: 0, 4

GET
H2 200 image4-768x430.png
www.securonix.com/wp-content/uploads/2024/04/ 343 KB
344 KB 144ms
143ms Image
image/webp 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/04/image4-768x430.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78870e56a28616865f1b5f056c4d8798eb8c986ef4247e9cb903c47759f23140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 18:38:26 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-hits: 0, 0
cf-polished: origFmt=png, origSize=538138
x-cache: MISS, MISS
content-disposition: inline; filename="image4-768x430.webp"
content-length: 351398
x-served-by: cache-chi-klot8100077-CHI, cache-ams21072-AMS
cf-bgj: imgq:85,h2pri
last-modified: Mon, 22 Apr 2024 20:59:11 GMT
server: cloudflare
x-timer: S1713897506.420771,VS0,VE594
etag: "6626cf9f-8361a"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JuOkWdN8GeJJ4nAV1jInwUDZI%2FwFFJqak%2FEuf%2BS3R30A4%2FTHY88vsy77YFCz%2BZqK3CWnTAR3tnE0PTNu6qcBiLMLgBrEULZ8n5qVyUB9XEgNpX3MI2qx0617YX3YHeClOTRat52LkYX5SVxcRI2d"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
x-styx-req-id: ac0ed0bf-01a0-11ef-88ef-529cc7717b5c
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 8796b735fb2d926d-FRA
x-pantheon-styx-hostname: styx-fe2-a-7d9c76749d-vp9dc

GET
H2 200 image2-768x452.png
www.securonix.com/wp-content/uploads/2024/04/ 169 KB
170 KB 133ms
133ms Image
image/webp 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/04/image2-768x452.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9714e0f3da25ffe42e0898631d4f3da125d6e3c82061bfa963030ebf8926aaf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 18:38:26 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-hits: 0, 0
cf-polished: origFmt=png, origSize=230804
x-cache: MISS, MISS
content-disposition: inline; filename="image2-768x452.webp"
content-length: 173044
x-served-by: cache-chi-klot8100048-CHI, cache-ams21048-AMS
cf-bgj: imgq:85,h2pri
last-modified: Mon, 22 Apr 2024 20:58:57 GMT
server: cloudflare
x-timer: S1713897506.434819,VS0,VE472
etag: "6626cf91-38594"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ga9v%2F%2FYt0aGbcbF16sCgRgqnngAsZw10%2B0Pe3DYVpgFfQE4v2cvfQeTxnD7keQG%2BgIOnpYwzPJMiDfvlAQVdTtPKpEWfE1hgNPEhosP1eaahYyTuoy93U%2FNh2tFAW8B8qKyhm8eWtFifsXIr941p"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
x-styx-req-id: ac111ca0-01a0-11ef-a88f-32e589a1b447
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 8796b735fb2e926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-76f6c9d98-8pj5p

GET
H2 200 image1-768x452.png
www.securonix.com/wp-content/uploads/2024/04/ 107 KB
108 KB 133ms
132ms Image
image/webp 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/04/image1-768x452.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8044a03f7f61ec94fd82991bc7bf3da95e0ae3e890053e3398534d4da395560b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 18:38:26 GMT
date: Wed, 24 Apr 2024 14:17:13 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-hits: 0, 0
cf-polished: origFmt=png, origSize=145923
x-cache: MISS, MISS
content-disposition: inline; filename="image1-768x452.webp"
content-length: 109562
x-served-by: cache-chi-klot8100171-CHI, cache-ams21082-AMS
cf-bgj: imgq:85,h2pri
last-modified: Mon, 22 Apr 2024 20:58:50 GMT
server: cloudflare
x-timer: S1713897506.415563,VS0,VE601
etag: "6626cf8a-23a03"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1V3%2FrDmpvMGWYrInulhWtZ%2Bya0V97FatfQ3W7940IOUDn04%2Bv3%2B6Rjxf5gd92RWZe8LJDfKJH1%2BQp1Dnj7IOT0ZJRA9KHE3O01k%2BH0BMXMrI%2B7HRFWyKz7u1oQnEvZyxOjhXbsx6G0Xk4QHB3L9z"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
x-styx-req-id: ac0e7137-01a0-11ef-8e9e-46874754af03
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 8796b735fb2f926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-76f6c9d98-g5t4g

GET
H2 200 image3-768x452.png
www.securonix.com/wp-content/uploads/2024/04/ 120 KB
121 KB 84ms
84ms Image
image/webp 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/04/image3-768x452.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

adba1e4ca0f5f76a58da3ee5c24c5a1a0ab75dbdcfee943dda5a53283e7c736e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 18:38:26 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-hits: 0, 0
cf-polished: origFmt=png, origSize=163267
x-cache: MISS, MISS
content-disposition: inline; filename="image3-768x452.webp"
content-length: 122792
x-served-by: cache-chi-klot8100054-CHI, cache-ams21065-AMS
cf-bgj: imgq:85,h2pri
last-modified: Mon, 22 Apr 2024 20:59:04 GMT
server: cloudflare
x-timer: S1713897506.434947,VS0,VE185
etag: "6626cf98-27dc3"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ovn9Y3VYThUAuzGRLvvhMLRmr69W%2FzfhnG1MgiGLWsa358kn3hMQeRyHXrWN9LS6IDK8dUfPpl2xUbvgl%2BYK6q19j0rcdWE6Wk8JmME2z8ugbu3pDoN3tFAYoWXimOQobzdEE27neFFUDlg7iRVA"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
x-styx-req-id: ac127a8b-01a0-11ef-811f-e627ebaa874e
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 8796b7371cbc926d-FRA
x-pantheon-styx-hostname: styx-fe2-a-7d9c76749d-7vdxr

GET
H2 200 forms2.min.js Show response
pages.securonix.com/js/forms2/js/ 199 KB
67 KB 298ms
70ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pages.securonix.com/js/forms2/js/forms2.min.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 05 Mar 2024 19:24:48 GMT
server: cloudflare
age: 4455
etag: "c11a0-31af8-612eecb9f6000"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 8796b7388ceb875e-WAW
expires: Wed, 24 Apr 2024 18:17:14 GMT

GET
H2 200 jquery.powertip.min.js Show response
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/ 11 KB
5 KB 55ms
55ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/jquery.powertip.min.js?ver=1.2.0

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:42 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136131
content-encoding: br
x-cache: MISS, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-hbk2r
x-served-by: cache-chi-klot8100113-CHI, cache-ams21033-AMS
last-modified: Sat, 13 Apr 2024 23:49:16 GMT
server: cloudflare
x-timer: S1713821308.266109,VS0,VE3
etag: W/"661b19fc-2ae5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1TQd0mvHWMF%2FzEVO%2FV4TGJBW%2BKRNnsA%2FyXdgchGx1nVIBMCm8T0D4hKC%2FNxKF4%2BRMQZtQ6no%2BFee6t9awgI64iEGPjKStSPA01IRANhgf%2FM%2Bwr45xO0yoGr6jOwNC6A1axrgQTzRtwBe6lh1rS6%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 87369e46-fa6d-11ee-b096-6ee28b929e97
cache-control: max-age=31622400
cf-ray: 8796b737bd88926d-FRA
x-cache-hits: 0, 4

GET
H2 200 maps_points.js Show response
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/ 504 B
803 B 56ms
55ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/maps_points.js?ver=1.2.2

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb698b4af30a506bea5e24025b0f742db88461e40a7f9f2f24293ad810bdf842

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:42 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136129
cf-polished: origSize=606
content-encoding: br
x-cache: MISS, HIT
x-cache-hits: 0, 4
x-served-by: cache-chi-klot8100147-CHI, cache-ams21046-AMS
cf-bgj: minify
last-modified: Sat, 13 Apr 2024 07:30:43 GMT
server: cloudflare
x-timer: S1713821308.274312,VS0,VE3
etag: W/"661a34a3-25e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jbWhrrsvBqckJ6xl5x6yEZt5DZEIuRG5lsNnKZdcGYA6WOUHBTKc3JQcpAJqgqXocVrGlV3UG79vzVQd3gtRTF2oL5pu9CQS11OVFAAj4bsJsIhFGUNBhdld%2B1unb7eesx1nxrZHbwo4EzsEN5l7"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 873e611d-fa6d-11ee-93e3-aafe187c636f
cache-control: max-age=31622400
cf-ray: 8796b7380dc9926d-FRA
x-pantheon-styx-hostname: styx-fe2-a-57d8d64c7d-9ngfg

GET
H2 200 modernizr.js Show response
www.securonix.com/wp-content/themes/securonix/assets/js/vendor/ 16 KB
6 KB 71ms
71ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/modernizr.js?ver=1713887471

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f060e210fa92b0bce82108a417cbf3f4f0ded2dc69a8b293db44da9f4b24c23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 16:01:25 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-polished: origSize=50144
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-served-by: cache-chi-kigq8000119-CHI, cache-ams21072-AMS
cf-bgj: minify
last-modified: Tue, 23 Apr 2024 03:46:53 GMT
server: cloudflare
x-timer: S1713888086.904047,VS0,VE137
etag: W/"66272f2d-c3e0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DxE0UeYNlIkazAzBR31Ogb5IfPqosA8TQCYJ5w1GawWagHV53BIppdcyAmEi1Jwcn9A2ah34uLcmcnzdjeXeisLDBuErOOeis8m5xE6RgxiVMjpIkPTqmMyN7gdCTmeXYHjj5cKa%2FNyqbJz7sKEe"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: bcfdbed0-018a-11ef-93c2-66bc493bf3ef
cache-control: max-age=31622400
cf-ray: 8796b7386e10926d-FRA
x-pantheon-styx-hostname: styx-fe2-a-7d9c76749d-t244p

GET
H2 200 wow.min.js Show response
www.securonix.com/wp-content/themes/securonix/assets/js/vendor/ 8 KB
3 KB 111ms
108ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/wow.min.js?ver=1713887471

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7852a22b72ead62cfc4a1b1ca32874b3e222f232a991a6d1432313572f534135

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 16:01:25 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-cache: MISS, MISS
x-pantheon-styx-hostname: styx-fe2-a-7d9c76749d-8jqjj
x-served-by: cache-chi-kigq8000055-CHI, cache-ams21048-AMS
last-modified: Tue, 23 Apr 2024 03:46:53 GMT
server: cloudflare
x-timer: S1713888086.894801,VS0,VE120
etag: W/"66272f2d-1fdb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=udkFhfvYQiNjAzFNMCsQsR3eAJe93zR63vdXSmuTuALw4Mh5j63NxxcvcZ79OwAgN7Y9laJk7ftixoA7Jd47cDTScmTF%2BXcUc%2BIgdOL4ySPy1jefEzQXRHlucZAAa6Tu%2B90EIZb2Yi%2F7qpaN1ZLQ"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: bcfd08e9-018a-11ef-8a2d-862ce7c87cde
cache-control: max-age=31622400
cf-ray: 8796b7393f0c926d-FRA
x-cache-hits: 0, 0

GET
H2 200 select2.js Show response
www.securonix.com/wp-content/themes/securonix/assets/js/vendor/ 100 KB
24 KB 124ms
121ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/select2.js?ver=1713887471

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba711f4ae1f09fd05735a7b8ec5e0d70d271cf09212431fa192deaed9a324360

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 16:01:25 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-polished: origSize=155132
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-served-by: cache-chi-klot8100028-CHI, cache-ams21026-AMS
cf-bgj: minify
last-modified: Tue, 23 Apr 2024 03:31:48 GMT
server: cloudflare
x-timer: S1713888086.892142,VS0,VE150
etag: W/"66272ba4-25dfc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2sFF7eRifNaIeEAI8tGzhQDfVP89zQMG1XcDZ%2BCTzCWaLBZ6WlUqEdUpI8S6HsnCk5WpWl5zgSnkbk080y79j3m6FNGxD52IuiMbAHrR5ygZMQPI1c7d%2BwQnJ1vf2cR3K5aZTDTA0U%2FFhCl2XpJt"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: bcfc2a9a-018a-11ef-811f-e627ebaa874e
cache-control: max-age=31622400
cf-ray: 8796b7393f0f926d-FRA
x-pantheon-styx-hostname: styx-fe2-a-7d9c76749d-7vdxr

GET
H2 200 slick.min.js Show response
www.securonix.com/wp-content/themes/securonix/assets/js/vendor/ 36 KB
10 KB 128ms
126ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/slick.min.js?ver=1713887471

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22529609ad54b33ee1695008d3daa6e35f133849c49ee00d7e9bc02eb0dd9a56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 16:01:26 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-cache: MISS, MISS
x-pantheon-styx-hostname: styx-fe2-b-76f6c9d98-q8wht
x-served-by: cache-chi-klot8100021-CHI, cache-ams21059-AMS
last-modified: Tue, 23 Apr 2024 03:32:49 GMT
server: cloudflare
x-timer: S1713888086.912733,VS0,VE179
etag: W/"66272be1-9040"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yq35QwfjBs%2F9W%2FB%2BI%2BUaT1PoAsLJRl1EkdWGpGVy0y9OI3Dtbq7P7qniR25B5NfT8s6%2Fg3bzkvqE6YunnG405LiZ7fIJUxWOTnNdH%2BAaYItr8VLp7LCdT4dALSoOgYovZovgT6gN61MbHNOvTIMc"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: bd05c3e2-018a-11ef-b5ab-5ebfcd969e79
cache-control: max-age=31622400
cf-ray: 8796b7393f10926d-FRA
x-cache-hits: 0, 0

GET
H2 200 scripts.min.js Show response
www.securonix.com/wp-content/themes/securonix/assets/js/ 171 KB
45 KB 206ms
204ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/js/scripts.min.js?ver=1713887471

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5dc25b44f66a4a97302932d4e42507562ecd23f893b1669a791662a8ec00542

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 24 Apr 2025 16:01:26 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-cache: MISS, MISS
x-pantheon-styx-hostname: styx-fe2-b-76f6c9d98-8pj5p
x-served-by: cache-chi-kigq8000046-CHI, cache-ams21072-AMS
last-modified: Tue, 23 Apr 2024 15:51:11 GMT
server: cloudflare
x-timer: S1713888086.322706,VS0,VE170
etag: W/"6627d8ef-2ace1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9xFcMzw0I9Fw9CLZpyF1DDv8AB5vAO0HP3Eyuu5daz5V97Cm4s2dgS2txNVclOk8x5ZBMGGnUNdCxQoPexTGVlkh7IdZNZLb7zSv0cawtagNXPlnSRMkBwQhA71Ff0yfILp9BFD6Q%2FAJEmyhsv2q"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: bd3db442-018a-11ef-a88f-32e589a1b447
cache-control: max-age=31622400
cf-ray: 8796b7393f12926d-FRA
x-cache-hits: 0, 0

GET
H2 200 new-tab.js Show response
www.securonix.com/wp-content/plugins/page-links-to/dist/ 24 KB
9 KB 98ms
96ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.6

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:42 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136129
content-encoding: br
x-cache: HIT, HIT
x-cache-hits: 0, 4
x-served-by: cache-chi-kigq8000041-CHI, cache-ams21037-AMS
cf-bgj: minify
last-modified: Sat, 13 Apr 2024 23:49:16 GMT
server: cloudflare
x-timer: S1713821308.274952,VS0,VE2
etag: W/"661b19fc-609e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KwyY6POtgeP4OJ0Hv4BBGF0JnwjcMT5XQjJA4IHESL5P0hP2OPOJZXFgG%2FbRo9uDImIyqj6w9QmAkRe9PjcYA0gb%2B%2FwL7Ca8N5gP7CXfXMQ99fdiUg0mDYyIprmj61M198QzzJxN4XvjRfmPU%2BC%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 873f8c37-fa6d-11ee-93a3-66529c49ef00
cache-control: max-age=31622400
cf-ray: 8796b7393f15926d-FRA
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-rm6p6

GET
H2 200 ubermenu.min.js Show response
www.securonix.com/wp-content/plugins/ubermenu/assets/js/ 38 KB
10 KB 99ms
97ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/ubermenu/assets/js/ubermenu.min.js?ver=3.7.4

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58415d97eb0b5745ccfa6e5e2f996581ec39f6c4af80627d3dd3c06bc5977ca6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:42 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136129
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-nrk6l
x-served-by: cache-chi-kigq8000049-CHI, cache-ams21072-AMS
last-modified: Sat, 13 Apr 2024 22:49:36 GMT
server: cloudflare
x-timer: S1713821308.275254,VS0,VE2
etag: W/"661b0c00-9750"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XSPV9Tds20WwPv7eVEjja7OrmKU9DnJp2gRP%2BFk8aB2dFszTsAAzO3%2B%2FG95IpZrozE9C7dIkgw7JGxE1Gc2wLHNFrQt9M3rURj0fXXLTEBeAikNc2kcKLxnSJkOEb9eJLz5bwYl3h%2FVvvKB5vr%2FQ"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 87400aba-fa6d-11ee-91c8-7af237c31095
cache-control: max-age=31622400
cf-ray: 8796b7393f16926d-FRA
x-cache-hits: 0, 4

GET
H2 200 smush-lazy-load.min.js Show response
www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/ 8 KB
4 KB 105ms
103ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.14.2

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Tue, 15 Apr 2025 14:44:42 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136129
content-encoding: br
x-cache: MISS, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-bzdln
x-served-by: cache-chi-klot8100173-CHI, cache-ams21047-AMS
last-modified: Sat, 13 Apr 2024 22:49:36 GMT
server: cloudflare
x-timer: S1713821308.281265,VS0,VE3
etag: W/"661b0c00-1ef2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YYTIiamBaJ1OGGlUuTqLE5Fm2H33Ns4VsSy3VCxXTXjYiAqSv6ffmFs42wbjq4ENYMnrnJmmHUJMtZ5ngpmGJoDosTa1lfyPjo6xJdbKdILHyuJktdKRThVAlIw5%2BcgBc%2Bji04QyGtGUMavm%2FMNF"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 873f9309-fa6d-11ee-94a7-1a3b08b151cb
cache-control: max-age=31622400
cf-ray: 8796b7393f19926d-FRA
x-cache-hits: 0, 4

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 173ms
41ms Stylesheet
text/css 2a02:26f0:3500:16::215:148b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=pjm0fus&ht=tk&f=26034.26052.26053.26054.26055.26056.26057.26058.26059.26060.26061.26062.26063.26064.26065.26067.26068.26069.25998.25999.26000.26001.26016.26017.26018.26019.26036.26037.26046.26047.26070.26071.26072.26073.26074.26075.26076.26077.26078.26079.26080.26081.26082.26083.26086.26087&a=92827302&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/pjm0fus.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
last-modified: Fri, 23 Jun 2023 17:09:47 GMT
server: nginx
etag: "6495d1db-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 304ms
88ms Script
application/x-javascript 23.57.166.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.166.202 Dublin, Ireland, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-166-202.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 24 Apr 2024 14:17:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET lt-v3.js
lltrck.com/scripts/ 0
0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 298 KB
100 KB 162ms
73ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

12ebb4af381bec6aefb2e89f0f1512fbcaab283201fbe9b0c14796e46bb6ce84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 102313
x-xss-protection: 0
last-modified: Wed, 24 Apr 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 24 Apr 2024 14:17:14 GMT

GET
BLOB 200
OK 21dafd1f-a8ac-4bfe-9494-da7a5949f7e9
https://www.securonix.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.securonix.com/21dafd1f-a8ac-4bfe-9494-da7a5949f7e9
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 hero-coverage.png
www.securonix.com/wp-content/uploads/2022/04/ 3 KB
4 KB 98ms
97ms Image
image/webp 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2022/04/hero-coverage.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfb9e92353e3d4999e02a6f01a3551a87686ebf0180baf65b4c961f7061bcf52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe2-a-756dd76fc7-j7qzn
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
expires: Fri, 28 Mar 2025 11:19:19 GMT
cf-polished: origFmt=png, origSize=10885
x-cache: HIT, HIT
content-disposition: inline; filename="hero-coverage.webp"
backend-name: 34.123.8.55,9093
content-length: 3564
x-served-by: cache-chi-klot8100063-CHI, cache-ams21053-AMS
backend-ip-port: 6wd67qj6gjWStoHWt9QqLM--F_styx_fe2_a_sharedvpc_dmz_01
cf-bgj: imgq:85,h2pri
last-modified: Wed, 20 Apr 2022 17:31:36 GMT
server: cloudflare
x-timer: S1713826754.792869,VS0,VE2
etag: "62604378-2a85"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xLbjBlv5AB5ms2OerAym5kS1WZTzsoEMcMWO0t8SiWZ7b1NAoR5u38hJMSaUVbNGwE%2BDBVoOCVnIKUPrSSAo1CmNw1nly%2Bkc%2FitvdGQMXiLA0aVmCQwF8pmkTpOBtl9cRRHqTRLRZ6bb3Me0UxOq"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
x-styx-req-id: dab83f0f-ec2b-11ee-92ab-86c79b107cd4
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 8796b7393f1c926d-FRA
x-cache-hits: 0, 0

GET
H2 200 l
use.typekit.net/af/46da36/00000000000000003b9acaf6/27/ 26 KB
26 KB 157ms
39ms Font
application/font-woff2 2a02:26f0:3500:16::215:1485
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/46da36/00000000000000003b9acaf6/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/pjm0fus.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1485 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 464b561ee00c86db1cddb80f2c9d6febbc2c1aa95f422fa73a4fb8ef7d5d5028

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/pjm0fus.css
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
server: nginx
etag: "de29fb2e3e401b15877c6b3a0953702fe7fa1105"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 26812

GET
H2 200 icomoon.ttf
www.securonix.com/wp-content/themes/securonix/assets/fonts/icons/ 5 KB
5 KB 57ms
56ms Font
application/x-font-ttf 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix/assets/fonts/icons/icomoon.ttf?folamw

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1713887471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a4d1cf1412729a6ebf14ef0c798f0b9c9dc0ecee9e06e912859e4c53380fb33b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1713887471
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Mon, 14 Apr 2025 02:48:09 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136129
x-cache: MISS, HIT
x-pantheon-styx-hostname: styx-fe2-a-57d8d64c7d-x4qsl
x-served-by: cache-chi-kigq8000049-CHI, cache-ams21045-AMS
last-modified: Fri, 12 Apr 2024 08:58:32 GMT
server: cloudflare
x-timer: S1713821308.417513,VS0,VE3
etag: W/"6618f7b8-1358"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fyqggP6P1NEdcMZ0rxxg1UIZ6CB9WIKMzZer1pE2dnZlTqYlR%2BYwXfR6E063nZLbOYgQFO5SJoh51Z%2BRWYNj9AHf%2B8YHYJ53Lf%2BDAMkgmnOG%2FWJXKeXWqQpQd%2FHHwiMgyjj1mjlJ3mzEVeOUn9c7"}],"group":"cf-nel","max_age":604800}
content-type: application/x-font-ttf
access-control-allow-origin: *
x-styx-req-id: 4302e881-f940-11ee-a59a-defe53ce599e
cache-control: max-age=31622400
cf-ray: 8796b7393f1d926d-FRA
x-cache-hits: 0, 3

GET
H2 200 QGYsz_wNahGAdqQ43Rh_fKDp.woff2
www.securonix.com/fonts.gstatic.com/s/worksans/v19/ 49 KB
50 KB 75ms
74ms Font
font/woff2 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 142129
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
content-length: 50668
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 01:13:52 GMT
server: cloudflare
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cf-apo-via: proxy
accept-ranges: bytes
cf-ray: 8796b7393f1f926d-FRA
timing-allow-origin: *
expires: Wed, 16 Apr 2025 01:12:51 GMT

GET
H2 200 l
use.typekit.net/af/027dd4/00000000000000003b9acafa/27/ 18 KB
19 KB 194ms
76ms Font
application/font-woff2 2a02:26f0:3500:16::215:1485
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/027dd4/00000000000000003b9acafa/27/l?subset_id=2&fvd=n6&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/pjm0fus.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1485 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: deb1aa1c2af7a0f084b58e34c78545593305a87b23f9f6e099849c1ace0c9dd6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/pjm0fus.css
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
server: nginx
etag: "de3ec5612df14c88441e596fbc2c46580ea46ed7"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 18912

GET
H2 200 l
use.typekit.net/af/829fc1/00000000000000003b9acaf8/27/ 19 KB
19 KB 198ms
81ms Font
application/font-woff2 2a02:26f0:3500:16::215:1485
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/829fc1/00000000000000003b9acaf8/27/l?subset_id=2&fvd=n5&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/pjm0fus.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1485 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 841ec96a41283cf23db2d69fe67d9beee3e9b222bccfe81ecf6edefc78e92151

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/pjm0fus.css
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
server: nginx
etag: "7fe86a8b0e0aad464390eb5e39aa627a47e9886d"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 18988

GET
H2 200 l
use.typekit.net/af/6d4bb2/00000000000000003b9acafc/27/ 26 KB
26 KB 162ms
45ms Font
application/font-woff2 2a02:26f0:3500:16::215:1485
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/6d4bb2/00000000000000003b9acafc/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/pjm0fus.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1485 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: da03f140d305f2abdf496bdd3fad9cfed87a237cf09f6a2edcec58bc5a1f044d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/pjm0fus.css
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
server: nginx
etag: "7d4a321fb4284bed9856c33aee6c065aba0855a7"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 26392

GET
H3 200 sm.25.html
static.addtoany.com/menu/ Frame BBED 0
0 109ms
64ms Document
text/html 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.securonix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
age: 13282
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8796b73a29dd9b28-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 24 Apr 2024 14:17:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1tXzSjrBK%2BxxO%2FU8O8Q9Ka8sPQGY19Q3uCLC09HLCVaCvEo9pBN0eWNIg33eYqyOhvvNlnvBnljHQiVok3H6QpVzsdpXL5ha1l1mb3qy4bcZtxR5pMW7PmEKSgeSu5sm%2B1muH%2FKB"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.BRQnzO8v.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 106ms
62ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b9b24f0aa59668e4d0a770ee7a294b9baa361a76a20ade8128cd0482a5d805

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 26389
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"25da5432b1057724b8210f17e9b9db05"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kR%2FG3xG%2BSv4y%2FGwVcKnvWtYBQYKY41dcvD2YBL1DA4f47eUWCEAV0s%2Fzjt6%2BLs5eNavwz0sBVqLPmhIPc1FLEYFalSRgHqkZKBFJbCmsg28Nkjixp11QmK08d8R6qCXrDkL%2FdbmB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 8796b73a2f923602-FRA

GET
H2 200 securonix-blue.svg
www.securonix.com/wp-content/uploads/2021/07/ 4 KB
2 KB 54ms
54ms Image
image/svg+xml 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2021/07/securonix-blue.svg

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a484da0ec050bccd6034a00ee39c4919c49ca749d0510f934a9ff5a07251a6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Fri, 04 Apr 2025 08:48:30 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136124
content-encoding: br
x-cache: HIT, HIT
x-pantheon-styx-hostname: styx-fe2-a-69d889f459-45grk
backend-name: 34.123.8.55,9093
x-served-by: cache-chi-klot8100025-CHI, cache-ams21054-AMS
backend-ip-port: 6wd67qj6gjWStoHWt9QqLM--F_styx_fe2_a_sharedvpc_dmz_01
last-modified: Fri, 03 Dec 2021 17:18:42 GMT
server: cloudflare
x-timer: S1713821308.032972,VS0,VE4
etag: W/"61aa5172-f3a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J7kL%2FQK4Wfnj5qG1HUrgY%2Bv8FcrohCgzAXwOrivKz6EX24m3sRNaJ4B7IShD%2FlRPQloA0pSg4yHtfxQ7VgwaayvoNo4tEAJY50S66saJECmn8BSBeuS9rgCGpY9kARj0EktHnK%2FU%2FUBduYkyopuP"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: f1e99d13-f196-11ee-bb35-7eb206d4b2da
cache-control: max-age=31622400
cf-ray: 8796b73a5809926d-FRA
x-cache-hits: 0, 0

GET
H2 200 wp-emoji-release.min.js Show response
www.securonix.com/wp-includes/js/ 18 KB
5 KB 52ms
52ms Script
application/x-javascript 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.3

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Thu, 17 Apr 2025 04:24:08 GMT
date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 136124
content-encoding: br
x-cache: MISS, HIT
x-pantheon-styx-hostname: styx-fe2-b-77f64f9968-rdqmx
x-served-by: cache-chi-kigq8000062-CHI, cache-ams21049-AMS
last-modified: Mon, 15 Apr 2024 13:09:29 GMT
server: cloudflare
x-timer: S1713821311.229853,VS0,VE3
etag: W/"661d2709-4904"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pd61BMjKqERQwNHU6EN3oyfSKKNWCQIJzWKyCpD0UrZB4OUqmHE8tOwxkhIc1eSMw1zppC4yEHvT%2Br5cCBofH%2BoSowWm0Mo9%2BLr9zzCbQPhpWTEoj1lgwBglbytcXNC0dATN6ELRimfTIteABJko"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
x-styx-req-id: 2ac309aa-fba9-11ee-a628-ee5a0d4b28d2
cache-control: max-age=31622400
cf-ray: 8796b73a680b926d-FRA
x-cache-hits: 0, 3

GET
H2 200 base.js Show response
embed.formhq.net/v1/ 6 KB
3 KB 152ms
51ms Script
application/javascript 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.formhq.net/v1/base.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5761
cf-polished: origSize=6385
x-xss-protection: 1; mode=block
cf-bgj: minify
last-modified: Tue, 01 Nov 2022 14:37:50 GMT
server: cloudflare
etag: W/"63612f3e-18f1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oZaSIFLRfXJJsft0vyZSID8bOh0Db6F5DSNHY42gA03f0Pp79c8syUs5ORRj77K%2B0IaZOr2rAHPglIir4fGFMgZsOm4anTooeu%2FTkSMiH9CzN%2FrtSPc0k3VQmI2IzKV%2Bugtvt0p0PrxKNHfhdidN"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=1800
cf-ray: 8796b73b4ef31c09-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 271 KB
94 KB 72ms
72ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0acab415ca9d13a1702c0c758e85f7bf49efe4d65b9638a143544a43541ae995

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95947
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 24 Apr 2024 14:17:14 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 65 KB
18 KB 184ms
46ms Script
application/javascript 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

7662680de47e214f4717c6a53442253949790694cc87ff1c69edaa6c01ba22b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 22 Apr 2024 20:11:50 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "6626c486-104b0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17921
expires: Wed, 24 Apr 2024 14:17:14 GMT

GET
H3 200 attributor.min.js Show response
cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/ 7 KB
3 KB 127ms
76ms Script
application/javascript 104.16.87.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/attributor.min.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 22237
x-jsd-version: master
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-etou8220072-FRA, cache-lga21958-LGA
x-jsd-version-type: branch
server: cloudflare
etag: W/"1da1-KfePJ46ikK9jPpNwOZncE3ivfdg"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0nBl5GjTlct6ouPf0WWG9PbCFWXfLNOZvbzepndbIxpne1CkkciDM9XqmyqZkCMqjA%2FxK0g053wp2Ilu%2F7zTZK%2FAe18YD45wr7VRql2TCBvNZr%2BPD03Vpkdw9IJsyEsRg7Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8796b73afd833518-WAW

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 221 KB
79 KB 87ms
87ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1004449086&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a03211caa3e15954dc4665b830b25335d3060481040b46bb02d951be62d6c40c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80785
x-xss-protection: 0
last-modified: Wed, 24 Apr 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 24 Apr 2024 14:17:14 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 160ms
67ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 24 Apr 2024 14:17:14 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 71BD3AE9E4624F10B0AA0FE1EE2CFBFB Ref B: FRA31EDGE0506 Ref C: 2024-04-24T14:17:14Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 136ms
40ms Script
application/javascript 2a02:26f0:3500:16::215:1484
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 07:42:51 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=13830
accept-ranges: bytes
content-length: 17238

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 85 KB
27 KB 153ms
41ms Script
text/javascript 2600:9000:2644:1000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:1000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4196ef94fe2c7befda378bfaad82f3e662be2b5eb1ba9aeffce466ba6bfd0bd4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

X-Amz-Version-Id: zwiFd6r3GuB2cGe7uW1NAFDjPwo1YxA2
Content-Encoding: gzip
Via: 1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
Date: Wed, 24 Apr 2024 13:35:42 GMT
Age: 2495
X-Amz-Cf-Pop: FRA60-P6
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Tue, 23 Apr 2024 14:35:04 GMT
Server: AmazonS3
Etag: W/"df5969d54f039097b5fc81144fa45a1f"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Max-Age: 600
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: zZDdBfTbD7L6a7iyN4tuIQSZav8xWRBnDSdtI1HHivV9c-57-p8nkg==

GET
H2

200

web-vitals.iife.js Show response
unpkg.com/web-vitals@3.5.2/dist/
Redirect Chain

https://unpkg.com/web-vitals/dist/web-vitals.iife.js
https://unpkg.com/web-vitals@3.5.2/dist/web-vitals.iife.js

7 KB
3 KB

56ms
56ms

Script
application/javascript

2606:4700::6811:f6cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@3.5.2/dist/web-vitals.iife.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Server

2606:4700::6811:f6cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c0e1f95aa09754b10449fd8cd7f2e76d8f232d1038b6cf7454db558ac79962e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 3615434
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HRWFH5XK9ND0J2MZ4B7JGPSN-fra
server: cloudflare
etag: W/"1bff-XBuNuslfZI/SL2xuiJqqum43R9A"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8796b73b99a22ba8-FRA

Redirect headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
fly-request-id: 01HW875DCEA0KG1GS7DM4XZ6TB-fra
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 330
server: cloudflare
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /web-vitals@3.5.2/dist/web-vitals.iife.js
cache-control: public, s-maxage=600, max-age=60
cf-ray: 8796b73b393f2ba8-FRA

GET
H2 200 r32rm8p2zmht.js Show response
js.driftt.com/include/1713968400000/ 221 KB
62 KB 543ms
448ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1713968400000/r32rm8p2zmht.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

28e132ea525a5b852dc1a77fcadc939ba1b70d68f321dd2ddeedc4b8a8cb93ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:15 GMT
x-amz-version-id: ECpAIUHXvnHr64vvrQweEad8ZWUjBUSY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 b2340053ff948864db4d5e3c0ab3f3ea.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Thu, 04 Apr 2024 20:13:54 GMT
server: istio-envoy
etag: W/"d320e83a1b98d0793815b4e22b96825b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: u7nyD-CqubuD7PBXrt8sWw3pjQcT0--7NrbsdvRSUToqWU_MzPqFmg==

GET
H3 200 de.js Show response
static.addtoany.com/menu/locale/ 750 B
1 KB 63ms
62ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/locale/de.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 8578
cf-polished: origSize=902
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"86610d84a116a5704d658324728b063f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jOhLgr6kCFwjwnL0P05vR4PSu%2BVCUV9TLEpmpTX%2FTWGNOeUth%2BdUPZW%2B9hfKlUG27pKPTr2XBuyDoRaC811Vgzibb70cvlz1LNnpmQT4YDSZiZVoaEJSh4gOzoLbQQD5EITfNx1P"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 8796b73acedb371f-FRA

GET
H3 200 linkedin.js Show response
static.addtoany.com/menu/svg/icons/ 435 B
820 B 59ms
59ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/linkedin.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7933
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"00b1b78053ab07c79bfea2e5a1db9d70"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=veYaCKFEFy55aZ1FtKNrHXogiV41ofzYfRgWHuGY1hgb9JulwDHKdnu72f69OCNVJMVevPQK5twdbARyldCe7w0Hrc8YdDPhp7oBaVEETcf74Ai%2BzDp0%2BgCc3iHSrT%2FVAFIWQbmr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8796b73ac8673602-FRA

GET
H3 200 twitter.js Show response
static.addtoany.com/menu/svg/icons/ 645 B
921 B 57ms
56ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/twitter.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3003867b66a32c12fdafeefc27cf06d906e5a99ba275550ab757f4bb04834636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7933
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"af2b829f9b79fabec7c0148a8b7e444b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLASyrz9c6pTk3ZL6oApUx6n1jHgWK6CjR3cumgWDIncYWAlJr%2FiTjQzVoYsqqmqy2QkgJWNZrcxB%2FAC%2FBPhNftohn6DeWcFot1Pt6%2FDGwWryQh8PWkUlR%2FSKXzDJO2VOAFyjMVH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8796b73ac8693602-FRA

GET
H3 200 facebook.js Show response
static.addtoany.com/menu/svg/icons/ 429 B
822 B 60ms
60ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/facebook.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b475960843a5619b907af1f0a89e3136bd5e6a4a700ec78cb417f302647cf49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7933
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"68925fa8e347041c6006837e73c518bc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1OfPYPRovNJrcYxH7ecLvgQkdpqAP37tyI7KofXQBbJKMtr%2Bu2TzI%2F1vmGAxsonSTbKGQk3xOjhievNDWBJSv5imA1ieglKHBH8fCPiKYmRg6gbVPnawt5TgE9QdZuHzT1OVjKTU"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8796b73ac86b3602-FRA

GET
H3 200 a2a.js Show response
static.addtoany.com/menu/svg/icons/ 182 B
678 B 55ms
55ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/a2a.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7933
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"0aca4ea1e5f8f250126a8e0c597dd969"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=caYQ%2BLWHOZa6c5Vwnv%2B6qQ4bd8Zy8%2B0Amnpzavb8UAvt0XFs45fnwXHECHI%2BYstEI6NjWGVbjFTZd0sb254i1PD1GMMMCMWdL7flPWqwrf%2Bjxiw7Lv23IHIO6qoL92oWDbRaJ3nR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8796b73ac86d3602-FRA

GET
H3 200 email.js Show response
static.addtoany.com/menu/svg/icons/ 415 B
815 B 61ms
61ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/email.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://static.addtoany.com/menu/modules/core.BRQnzO8v.js
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7933
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"eb2119ad4221a9d01abc336e06962867"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3pmHnG%2BUlLVo4FU7MyhJud6MNBguA5cUf3b3ixzKZkuUaERg8c%2BU3Rm%2F1Lt8ltk3bTbeliPtd6BpF8loIzkzsTBjHF%2BsAbwjrVN70sD6KX4PPq4mYpu46CSoybGgqJjOIi6mZYGh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8796b73ac8703602-FRA

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 85ms
85ms Script
application/x-javascript 23.57.166.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.166.202 Dublin, Ireland, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-166-202.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 24 Apr 2024 14:17:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Fri, 02 Aug 2024 14:17:14 GMT

POST
H/1.1 200
OK visitWebPage
179-djp-142.mktoresp.com/webevents/ 2 B
318 B 820ms
128ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://179-djp-142.mktoresp.com/webevents/visitWebPage?_mchNc=1713968234766&_mchCn=&_mchId=179-DJP-142&_mchTk=_mch-securonix.com-1713968234766-89297&_mchHo=www.securonix.com&_mchPo=&_mchRu=%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 24 Apr 2024 14:17:15 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 5738c54f-caa4-483a-a68d-da2721040bbc

POST
H2 204 collect
region1.analytics.google.com/g/ 0
256 B 141ms
47ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je44m0v891181397za200&_p=1713968234.779&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1115229834.1713968235&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&sid=1713968234&sct=1&seg=0&dt=Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1133
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.securonix.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
256 B 149ms
49ms Ping
text/plain 2a00:1450:400c:c07::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JPYDLXGD3Q&cid=1115229834.1713968235&gtm=45je44m0v891181397za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.securonix.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 113ms
63ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JPYDLXGD3Q&cid=1115229834.1713968235&gtm=45je44m0v891181397za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=260618371

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
703 B 315ms
194ms XHR
text/plain 2620:1ec:22::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:22::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.securonix.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D792A08A74894C678B4C77567507FF7D Ref B: VIEEDGE3121 Ref C: 2024-04-24T14:17:14Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.securonix.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYW2FPNragwszK744MGdQ==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-secu...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-secu...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-sec...

0
266 B

291ms
187ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true&e_ipv6=AQKs5Tuf_QCXYgAAAY8Qd8MHBOQsGONwim5kADWC6lCoP_4o9NlD0stCKruT50uo86gkU8c
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Apr 2024 14:17:15 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: DFDF9F58BD8D40188718B248391A8AF2 Ref B: DUS30EDGE0806 Ref C: 2024-04-24T14:17:15Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYW2FPWTKMAfR107rK32A==

Redirect headers

date: Wed, 24 Apr 2024 14:17:15 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: D2D5FE7A693544A896DDB87834DE8E59 Ref B: VIEEDGE3121 Ref C: 2024-04-24T14:17:15Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1713968234802&li_adsId=d2f6f936-a043-4e11-919e-64acdb6b0dca&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&tm=gtmv2&cookiesTest=true&e_ipv6=AQKs5Tuf_QCXYgAAAY8Qd8MHBOQsGONwim5kADWC6lCoP_4o9NlD0stCKruT50uo86gkU8c
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYW2FPRrdafnGHJOXrfBg==

GET
H2 200 bWFya2V0bw.js Show response
embed.formhq.net/v1/platforms/ 422 B
577 B 53ms
53ms Script
application/javascript 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.formhq.net/v1/platforms/bWFya2V0bw.js

Requested by

Host: embed.formhq.net
URL: https://embed.formhq.net/v1/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 326
cf-polished: origSize=423
x-xss-protection: 1; mode=block
cf-bgj: minify
last-modified: Tue, 02 Aug 2022 14:00:38 GMT
server: cloudflare
etag: W/"62e92e06-1a7"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EUaZBc0FC30v2LRqNYOdKkvrill9YoSsGqf%2F%2BK08fuI6HswsXj7dGTLUjh0wX4uxEegAbEDwHjCB8IstlK80HG%2FR4DSDgG8LSwEQqPcpP9HKvl%2FgGOSKbiZLXdpQYkGkbSoTLpAnrEZdDfhkSjbO"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=1800
cf-ray: 8796b73baf631c09-FRA

GET
H2 204 27010718.js Show response
bat.bing.com/p/action/ 0
118 B 67ms
67ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/27010718.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Wed, 24 Apr 2024 14:17:14 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BDD3674FBC7B498BB38180A8CF2182AD Ref B: FRA31EDGE0506 Ref C: 2024-04-24T14:17:14Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
285 B 147ms
147ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=27010718&tm=gtm002&Ver=2&mid=93e2c578-62ba-4af2-8472-2c6122f4f117&sid=596e2f70024511ef89b1db69ea91bc6e&vid=596e28b0024511ef8afa9be32fe6de5e&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix&p=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&r=&lt=951&evt=pageLoad&sv=1&rn=107293

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 24 Apr 2024 14:17:14 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 64C1B2FCE177413F9A991EC7606F5175 Ref B: FRA31EDGE0506 Ref C: 2024-04-24T14:17:14Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

80ms
42ms

Script
application/javascript

2600:9000:2644:1000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Protocol: HTTP/1.1
Server: 2600:9000:2644:1000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Date: Wed, 24 Apr 2024 04:14:58 GMT
Via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
Age: 36140
X-Amz-Cf-Pop: FRA60-P6
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: CZ5NYRViXeyN00yDhYWeb53tPr7rY7-gRe-H8ML4F7Ji4eX0JF2meA==

Redirect headers

Date: Wed, 24 Apr 2024 00:28:41 GMT
Via: 1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
Age: 49712
X-Amz-Cf-Pop: FRA60-P6
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: _zjasw-uGQKbMrZc1vDtwge52hsM5A6gbbYC4WU1UGqmdnBAzi10ng==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/ 9 KB
4 KB 80ms
40ms Script
text/javascript 2600:9000:2644:1000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:1000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

X-Amz-Version-Id: qMw0hUZztAJRDbnLXyRBSNN1sEfLmNeB
Content-Encoding: gzip
Via: 1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
Date: Wed, 24 Apr 2024 14:11:56 GMT
Age: 479
X-Amz-Cf-Pop: FRA60-P6
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Mon, 22 Apr 2024 11:46:12 GMT
Server: AmazonS3
Etag: W/"706be4fd28aeb971d2ff83a528c2073a"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Max-Age: 600
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: IQzrtV5maZ48gk29mF7Y-6EObvaoHtZgVQC7m4WnV7Pz06c5Dryfow==

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 54ms
46ms XHR
text/html 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a92-123-26-233.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:14 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.securonix.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
310 B 205ms
71ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: c829514739663b0fbaa1e5b4da63fecddb091258f1f8cb852c5e54e1b3fce9af

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:15 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.securonix.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:92::5
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1713968234953_34901612_87779793_22_829_39_103_219";dur=1
content-length: 19
expires: Wed, 24 Apr 2024 14:17:15 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 131ms
123ms Image
image/gif 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=af384542-af2f-47e3-8493-30e243660e42&session=76052521-2561-44f4-8279-556f6c6781f5&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A14%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=b7f24f50-f1e8-4418-8378-976b74e9de4e&v=1.1.17

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:14 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 24 Apr 2024 14:17:14 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 130ms
122ms Image
image/gif 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=af384542-af2f-47e3-8493-30e243660e42&session=76052521-2561-44f4-8279-556f6c6781f5&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2024%20Apr%202024%2014%3A17%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205b12115ad17914938bf7667643ca0d3%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2024%20Apr%202024%2014%3A17%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2024%20Apr%202024%2014%3A17%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2024%20Apr%202024%2014%3A17%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2245bc92abc111f3fccbf9c8779059ecfc1d69c9e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2024%20Apr%202024%2014%3A17%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=b7f24f50-f1e8-4418-8378-976b74e9de4e&v=1.1.17

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:14 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 24 Apr 2024 14:17:14 GMT

GET
H2 200 VJKZ2AZ6BRDQFPNHOW6CAP Show response
d.adroll.com/consent/check/ 490 B
583 B 174ms
56ms Script
application/javascript 2a05:d018:cc3:fe04:48dc:ec6b:8288:f981
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/VJKZ2AZ6BRDQFPNHOW6CAP?pv=52943042516.165215&arrfrr=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&_s=716caf57101be2fa7d3bbadc2659902c&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d018:cc3:fe04:48dc:ec6b:8288:f981 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: eeb3ca2cc9fc24486f0af968dd0fcf78b7f81ae4ed162ce4bf98e6df60158636

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:15 GMT
server: nginx/1.22.1
content-length: 490
content-type: application/javascript

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
709 B 114ms
45ms XHR
application/json 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 76fb07abb286175333e05f32d127f4972982a5419adf2d7209fb827ddb6220eb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token 45bc92abc111f3fccbf9c8779059ecfc1d69c9e6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-6s-CustomID: WebTag1.0 05b12115ad17914938bf7667643ca0d3
Referer: https://www.securonix.com/
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 2960723789272006766
date: Wed, 24 Apr 2024 14:17:15 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://www.securonix.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 387

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 118ms
41ms Preflight 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.securonix.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.securonix.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Wed, 24 Apr 2024 14:17:15 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 5402525041952250699

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 157ms
157ms Image
image/gif 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=af384542-af2f-47e3-8493-30e243660e42&session=76052521-2561-44f4-8279-556f6c6781f5&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=b7f24f50-f1e8-4418-8378-976b74e9de4e&v=1.1.17

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:15 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 24 Apr 2024 14:17:15 GMT

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 413 KB
83 KB 43ms
43ms Script
text/javascript 2600:9000:2644:1000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:1000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3ec093226dbb4c5f2767562378e80a955db377003a72f5ff70cd65040983090f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

X-Amz-Version-Id: E8Xqd_XzP1xGQPgJ2rRArNdUFnSvN3pa
Content-Encoding: gzip
Via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
Date: Wed, 24 Apr 2024 14:14:24 GMT
Age: 172
X-Amz-Cf-Pop: FRA60-P6
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Thu, 08 Feb 2024 21:46:10 GMT
Server: AmazonS3
Etag: W/"e1dc09168683fa834f599c01bb66de29"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Max-Age: 600
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: u4clskMAdPVEnCpLxfW3T0A3mPQAtWMxbs84QT1c_rCKOX4iahef0g==

GET
H/1.1 200
OK nextroll-32x32.png
s.adroll.com/i/favicon/ 2 KB
2 KB 40ms
40ms Image
image/png 2600:9000:2644:1000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.adroll.com/i/favicon/nextroll-32x32.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:1000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

X-Amz-Version-Id: eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Date: Wed, 24 Apr 2024 06:32:50 GMT
Via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
Age: 28007
X-Amz-Cf-Pop: FRA60-P6
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 1615
Last-Modified: Mon, 28 Jun 2021 18:19:21 GMT
Server: AmazonS3
Etag: "403a0a7dcf2d617e7ea852bfb9d11945"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: Hc4DWSFGXeSpeOGKe_BIezPvd_galF-4fnwfVpfpUUDLrCcfcH6H7A==

GET
H2 200 core
js.driftt.com/ Frame 74F4 0
0 222ms
145ms Document
text/html 18.245.86.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=fc05be39-de21-4ddc-ad01-0b2ea514ef57&sessionStarted=1713968235.667&campaignRefreshToken=ae398331-2a9f-4d16-bf67-5c568cc0ac1d&hideController=false&pageLoadStartTime=1713968233841&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1713968400000/r32rm8p2zmht.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-14.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.securonix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 24 Apr 2024 14:17:15 GMT
etag: W/"f4497bfb5a87b7c4365be2cac47f8d1a"
last-modified: Thu, 04 Apr 2024 19:46:21 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 13ad77f5993668d67b8168f460ba6368.cloudfront.net (CloudFront)
x-amz-cf-id: KF3HXOK8JTgO4DmZrlqOKrxv94aAr7W-ZCJNwfxzAjZ6L9qn6qHupw==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: ZBEiLR5jfh3iii3cnfTNRQsxvVBIMKla
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 14

GET
H2 200 chat
js.driftt.com/core/ Frame 191F 0
0 218ms
142ms Document
text/html 18.245.86.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1713968233841

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1713968400000/r32rm8p2zmht.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-14.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.securonix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 24 Apr 2024 14:17:15 GMT
etag: W/"f4497bfb5a87b7c4365be2cac47f8d1a"
last-modified: Thu, 04 Apr 2024 19:46:21 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 13ad77f5993668d67b8168f460ba6368.cloudfront.net (CloudFront)
x-amz-cf-id: bgKqKl_ChxaanniecGn5JjJELofof0qqp-eKWP3huY4iOysxgzwoiA==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: ZBEiLR5jfh3iii3cnfTNRQsxvVBIMKla
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 13

GET
H2 200 nr-rum-1.257.0.min.js Show response
js-agent.newrelic.com/ 50 KB
18 KB 150ms
47ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.257.0.min.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

ac2185eaf27db9d83c2688a55c428a5f18bbe41d8f769c58f41f081b8b17834b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Origin: https://www.securonix.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: hDZawLvU_7lPCCc8KE3sqLucpiUuFFEu
content-encoding: br
via: 1.1 varnish
date: Wed, 24 Apr 2024 14:17:15 GMT
strict-transport-security: max-age=300
x-amz-request-id: YB66H9WE205CV402
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 17464
x-amz-id-2: J0F4Vx172T0B6pfFS4EfzJaBRrtdm4vPuW6A3bRinEzKNwaCOAfMD47HXJd0g6PMz3g1gBzkOvk=
x-served-by: cache-mxp6926-MXP
last-modified: Fri, 19 Apr 2024 00:43:41 GMT
server: AmazonS3
etag: "04045b88714f08119a0e2fcb74624f22"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 98812

GET
H2 403 Featured_Thumbnail_477X364.jpg
www.securonix.com/wp-content/uploads/2023/04/ 17 KB
17 KB 50ms
49ms Image
text/html 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2023/04/Featured_Thumbnail_477X364.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5310b6e161788c504b1bc9d90b7dba777c80b10bc02a8b077b37045fe576e5d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:15 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin
cf-chl-out: LYeUmev+ubu+WYr07zV8rKfoS+Qa2aHnsr4Z2XdfOnoH1w747ZBboKX+asOeoEH0WZri4c6MoaJTohXzkyeFIgdOgCTCXktIgmgW77wOIalPzR6D13KZZdL/cjNCWb30NwnfzqdsEOS/FCv9flYbIg==$clTUxzXxc/3JdzcNet92TQ==
referrer-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy: same-origin
cf-mitigated: challenge
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zWZGCYNh9sA4iSUz4LspAH9tC452XVKDdh1Kwjysn5aITBdSvqzeszOJDwBLbFqpxySWJUu%2BOteL7pGyReZx%2FuRwjxyYOQeaWH38ZMc9xPNJg9Td1uc0QLKYKVmHlIqPmYPcyGisj5zjk59SWjkh"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
origin-agent-cluster: ?1
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray: 8796b7411df9926d-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 403 gartner_innovationInsightReport_21_menuImg.jpg
www.securonix.com/wp-content/uploads/2021/12/ 17 KB
17 KB 51ms
50ms Image
text/html 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2021/12/gartner_innovationInsightReport_21_menuImg.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

621088d030f9c013f2688ff5e14ce41f831682225853459e31f0c80f499e9112

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:15 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin
cf-chl-out: 3d+FqZAoX/UK6YbAGzOxFG/vDl39+35A2HxGRXpOekcqu4y9rlqmZPI+efB1w5Z8FNydxTtBiW99FpOoWLyZitWvKrZQNs70a7fhX2Qt49CVMO73qJVlA9eBBYea1fphMW4aqjageEid/I1OYwCTDw==$Pq4q8N71gXodgoJBcWxzqA==
referrer-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy: same-origin
cf-mitigated: challenge
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UlpuX%2BHMlFHkJwiNiLJolBArb0fU%2Bs%2FLwI0HTHgc4Jym%2BZjhXnNg67ukA1umg9si8oofu4BKJmovtrHLrNb6XKogSp%2Fa7xWsagK3v%2FzzBsuJMn2q2UWHHoYy9R4B0zcEt63hwmI8cxoutHLO6ecR"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
origin-agent-cluster: ?1
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray: 8796b7411dfa926d-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT

POST
H/1.1 200 NRJS-e6ece394b0ed1b033c0 Show response
bam.nr-data.net/1/ 151 B
602 B 684ms
590ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-e6ece394b0ed1b033c0?a=989077289&v=1.257.0&to=ZwNaNkBSWkAHVUZRCV5JeQFGWltdSUVbVgFcAxUAXlxT&rst=2188&ck=0&s=efb6c30e7367971c&ref=https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/&ap=1645&be=181&fe=1844&dc=771&at=S0RZQAhISU4%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1713968233653,%22n%22:0,%22f%22:0,%22dn%22:10,%22dne%22:10,%22c%22:10,%22s%22:49,%22ce%22:103,%22rq%22:103,%22rp%22:181,%22rpe%22:189,%22di%22:951,%22ds%22:951,%22de%22:952,%22dc%22:2013,%22l%22:2022,%22le%22:2025%7D,%22navigation%22:%7B%7D%7D&fp=771&fcp=771
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-rum-1.257.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: af64f318f5d1e691c1437d3caa39d375cab4d8d8aca0f127ccb9cd9939226a3c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 24 Apr 2024 14:17:16 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.securonix.com
access-control-expose-headers: Date
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
timing-allow-origin: https://www.securonix.com
Content-Length: 151
x-served-by: cache-fra-etou8220088-FRA

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 147ms
147ms Image
image/gif 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=af384542-af2f-47e3-8493-30e243660e42&session=76052521-2561-44f4-8279-556f6c6781f5&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A14%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=b7f24f50-f1e8-4418-8378-976b74e9de4e&v=1.1.17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:16 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 24 Apr 2024 14:17:16 GMT

GET
H2 403 cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png
www.securonix.com/wp-content/uploads/2021/12/ 17 KB
8 KB 48ms
47ms Other
text/html 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

223d9b9e2c2ae22e5b6306adca73fb74e2c5de7b9d3994f216524360a093a8ce

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:16 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin
cf-chl-out: /Svsxf6/sxXCPJrDQ1JivCb+fwQDVPU1IbBbsyO2tsFAyoTqiUFbf1KSsvsiqhWJYDLOZDx2zyMgfHs0O1BVKHBUYVUsO8WJjeJ5Y5WXmFQNgIVuQ9KUgkSj9veSJMWZuT0Iw9UAHcDGTohMn0VbdQ==$TXvyMDUs9mKcLeVBc5Y6vw==
referrer-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy: same-origin
cf-mitigated: challenge
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U43%2FDmUes5zPX14WtDLVl1IigDgJvXGu7yq27o8q%2F%2B201MYpesZaNG0mlQKXvONIqTRZvusaKTX77RsDCCG%2BskKpSnFXsWYn5LcPLHkIVoC1ozwlOFmGPl70lyk4CxgKtDi%2FJJnUJ5uNjykrc2fS"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
origin-agent-cluster: ?1
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray: 8796b744896b926d-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 403 cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-192x192.png
www.securonix.com/wp-content/uploads/2021/12/ 17 KB
8 KB 65ms
64ms Other
text/html 2606:4700:3108::ac42:2b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-192x192.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41c80e4a0a8b311e4985eddb0507d8455278aec7c80cf8ba5fa0d19001759177

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 14:17:16 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin
cf-chl-out: slVrWXIKZIxEtmhkrK+ksklT1we2T3U9XnpVEv4gY9pKxLSemoAzfkXRvzcF8XErKbIW0IS95wqqMXOZup8s3EXMbfOR9IdAT843sAg2dDbTRZTerM6yFa2MfsWaalT3UAO6gYZ58iaqF1uv4n3Z5Q==$ZOZLYnQS/ddn4HvM7vxnwA==
referrer-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy: same-origin
cf-mitigated: challenge
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z5duR2b6gb9GU3LeB7T9belGKB1gsOkj9hEwQsO%2FqfTBrbK9qYqkIvURWMMqUXsiOWkWgBbawRNlX9oFzM61ecn4oPLD8YYdbwKCb14wvq0inVGfZFOID71wnWs2gXDcNadfg09N9Uu8Uc7RML%2By"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
origin-agent-cluster: ?1
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray: 8796b744d9c2926d-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 122ms
121ms Image
image/gif 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=af384542-af2f-47e3-8493-30e243660e42&session=76052521-2561-44f4-8279-556f6c6781f5&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=b7f24f50-f1e8-4418-8378-976b74e9de4e&v=1.1.17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:16 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 24 Apr 2024 14:17:16 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 118ms
118ms Image
image/gif 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=af384542-af2f-47e3-8493-30e243660e42&session=76052521-2561-44f4-8279-556f6c6781f5&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=b7f24f50-f1e8-4418-8378-976b74e9de4e&v=1.1.17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:17 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 24 Apr 2024 14:17:17 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 150ms
149ms Image
image/gif 92.123.26.233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=af384542-af2f-47e3-8493-30e243660e42&session=76052521-2561-44f4-8279-556f6c6781f5&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2024%20Apr%202024%2014%3A17%3A17%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20team%20(STR)%20observed%20an%20interesting%20attack%20campaign%20dubbed%20FROZEN%23SHADOW%20which%20leveraged%20SSLoad%20malware%20and%20Cobalt%20Strike%20implants%20resulting%20in%20the%20attackers%20being%20able%20to%20pivot%20and%20take%20over%20the%20entire%20network%20domain.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Research%20Security%20Advisory%3A%20Analysis%20of%20Ongoing%20FROZEN%23SHADOW%20Attack%20Campaign%20Leveraging%20SSLoad%20Malware%20and%20RMM%20Software%20for%20Domain%20Takeover%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fsecuronix-threat-research-security-advisory-frozenshadow-attack-campaign%2F&pageViewId=b7f24f50-f1e8-4418-8378-976b74e9de4e&v=1.1.17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.26.233 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a92-123-26-233.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.securonix.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 14:17:19 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 24 Apr 2024 14:17:19 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: lltrck.com
URL: https://lltrck.com/scripts/lt-v3.js?llid=23883

Verdicts & Comments Add Verdict or Comment

120 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pages.securonix.com/	1970-01-20 20:06:10	Name: __cf_bm Value: vo8xFFwghUnJcWvoYxoM8gZDkhpM1X8.fPlXkSYPY.4-1713968234-1.0.1.1-dcYg6x.Pcuo2OzOHLMkJbU1RSa5wKR8HRrwkEE.dHRW1UVy9PPXG0eClFhNCitMr5XF2WROaLyfR.LlE4B6NTA
www.securonix.com/	1969-12-31 23:59:59	Name: wp-wpml_current_language Value: en
.securonix.com/	1970-01-20 22:15:44	Name: _gcl_au Value: 1.1.2021400430.1713968235
.securonix.com/	1970-01-21 05:42:08	Name: _mkto_trk Value: id:179-DJP-142&token:_mch-securonix.com-1713968234766-89297
.securonix.com/	1970-01-21 05:42:08	Name: _ga Value: GA1.1.1115229834.1713968235
.securonix.com/	1970-01-21 05:42:08	Name: attr_first Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20set)%22%2C%22content%22%3A%22(not%20set)%22%2C%22source_platform%22%3A%22(not%20set)%22%2C%22marketing_tactic%22%3A%22(not%20set)%22%2C%22creative_format%22%3A%22(not%20set)%22%2C%22adgroup%22%3A%22(not%20set)%22%2C%22id%22%3A%22(not%20set)%22%7D
.securonix.com/	1970-01-20 20:06:10	Name: attr_last Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20set)%22%2C%22content%22%3A%22(not%20set)%22%2C%22source_platform%22%3A%22(not%20set)%22%2C%22marketing_tactic%22%3A%22(not%20set)%22%2C%22creative_format%22%3A%22(not%20set)%22%2C%22adgroup%22%3A%22(not%20set)%22%2C%22id%22%3A%22(not%20set)%22%7D
.securonix.com/	1970-01-20 20:07:34	Name: _uetsid Value: 596e2f70024511ef89b1db69ea91bc6e
.securonix.com/	1970-01-21 05:27:44	Name: _uetvid Value: 596e28b0024511ef8afa9be32fe6de5e
www.securonix.com/	1970-01-21 05:42:08	Name: _gd_visitor Value: af384542-af2f-47e3-8493-30e243660e42
www.securonix.com/	1970-01-20 20:06:22	Name: _gd_session Value: 76052521-2561-44f4-8279-556f6c6781f5
.bing.com/	1970-01-21 05:27:44	Name: MUID Value: 12351A13A93D689509120E78A8B66930
.linkedin.com/	1970-01-20 22:15:44	Name: li_sugr Value: 756e2497-48eb-4962-8d40-f50f2c0d9e20
.linkedin.com/	1970-01-21 04:51:44	Name: bcookie Value: "v=2&6a86733e-76cd-4db1-8ab1-3ab1cc374f2f"
.linkedin.com/	1970-01-20 20:07:34	Name: lidc Value: "b=TGST09:s=T:r=T:a=T:p=T:g=2757:u=1:x=1:i=1713968235:t=1714054635:v=2:sig=AQFK13UPOzHP5yiQGDLuPND1xwoX7zNR"
.linkedin.com/	1970-01-21 00:25:20	Name: li_gc Value: MTswOzE3MTM5NjgyMzU7MjswMjEaqfxSdPnuFE7/FuXPEVxZlc+C17GLEqeUtlGUQ5MQbQ==
www.securonix.com/	1970-01-20 20:06:10	Name: drift_campaign_refresh Value: ae398331-2a9f-4d16-bf67-5c568cc0ac1d
www.securonix.com/	1970-01-21 05:42:08	Name: drift_aid Value: d296bc68-5004-4b44-b37f-6b0c760db5e2
www.securonix.com/	1970-01-21 05:42:08	Name: driftt_aid Value: d296bc68-5004-4b44-b37f-6b0c760db5e2
.securonix.com/	1970-01-21 05:42:08	Name: _ga_JPYDLXGD3Q Value: GS1.1.1713968234.1.0.1713968237.57.0.0

21 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://js.driftt.com/include/1713968400000/r32rm8p2zmht.js Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.securonix.com/blog/securonix-threat-research-security-advisory-frozenshadow-attack-campaign/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://www.securonix.com/wp-content/uploads/2023/04/Featured_Thumbnail_477X364.jpg Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://www.securonix.com/wp-content/uploads/2021/12/gartner_innovationInsightReport_21_menuImg.jpg Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-192x192.png Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

179-djp-142.mktoresp.com
ajax.googleapis.com
b.6sc.co
bam.nr-data.net
bat.bing.com
c.6sc.co
cdn.jsdelivr.net
d.adroll.com
embed.formhq.net
epsilon.6sense.com
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
js.driftt.com
lltrck.com
munchkin.marketo.net
p.typekit.net
pages.securonix.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.adroll.com
snap.licdn.com
static.addtoany.com
stats.g.doubleclick.net
unpkg.com
use.typekit.net
www.google.de
www.googletagmanager.com
www.securonix.com
lltrck.com
104.16.87.20
104.17.74.206
13.107.42.14
13.248.142.121
142.250.186.35
162.247.243.29
172.67.39.148
18.245.86.14
18.245.86.87
192.28.144.124
2001:4860:4802:34::36
23.57.166.202
2600:9000:2644:1000:6:9280:1080:93a1
2602:816:5001::39
2606:4700:10::6816:47c5
2606:4700:3108::ac42:283b
2606:4700:3108::ac42:2b19
2606:4700::6811:f6cb
2620:1ec:22::14
2620:1ec:c11::237
2a00:1450:4001:81d::2008
2a00:1450:4001:81d::200a
2a00:1450:400c:c07::9d
2a02:26f0:3500:16::215:1484
2a02:26f0:3500:16::215:1485
2a02:26f0:3500:16::215:148b
2a02:26f0:ab00::214:8e70
2a05:d018:cc3:fe04:48dc:ec6b:8288:f981
92.123.26.233
0acab415ca9d13a1702c0c758e85f7bf49efe4d65b9638a143544a43541ae995
12ebb4af381bec6aefb2e89f0f1512fbcaab283201fbe9b0c14796e46bb6ce84
175eab7bef961e3d69c7c97f5371d532f30be4547670ba55578ed1af53d3114d
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
223d9b9e2c2ae22e5b6306adca73fb74e2c5de7b9d3994f216524360a093a8ce
22529609ad54b33ee1695008d3daa6e35f133849c49ee00d7e9bc02eb0dd9a56
27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db
28e132ea525a5b852dc1a77fcadc939ba1b70d68f321dd2ddeedc4b8a8cb93ec
3003867b66a32c12fdafeefc27cf06d906e5a99ba275550ab757f4bb04834636
32526fdcae3037b6c2d64e0728c146d0c6ba44bb3b663af970f05feab4393b15
3608f6b7fb9eb1cd747edb1f4f738b4e09220ea10ecebc5e47c917a6d2feaea1
3a484da0ec050bccd6034a00ee39c4919c49ca749d0510f934a9ff5a07251a6c
3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43
3ec093226dbb4c5f2767562378e80a955db377003a72f5ff70cd65040983090f
4196ef94fe2c7befda378bfaad82f3e662be2b5eb1ba9aeffce466ba6bfd0bd4
41c80e4a0a8b311e4985eddb0507d8455278aec7c80cf8ba5fa0d19001759177
435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
464b561ee00c86db1cddb80f2c9d6febbc2c1aa95f422fa73a4fb8ef7d5d5028
4b475960843a5619b907af1f0a89e3136bd5e6a4a700ec78cb417f302647cf49
4b9257e3e9c959214ddfab833a69a021ae6557403efe76afcbee259621175274
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58415d97eb0b5745ccfa6e5e2f996581ec39f6c4af80627d3dd3c06bc5977ca6
5e2d296664123aed1106464a611ef20234a6eed68d82ed5b1afd66660b185c59
621088d030f9c013f2688ff5e14ce41f831682225853459e31f0c80f499e9112
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984
6e0cc78c402cbc02fdfd41cd77c5fd6ffbd8066cc07935ea8eb5f3fcc59744a3
6eb4cf02a13fd5ba1886458ccf1596b2fcf5c63a26c437b61e4ee58f5e3f7b4f
7662680de47e214f4717c6a53442253949790694cc87ff1c69edaa6c01ba22b5
76fb07abb286175333e05f32d127f4972982a5419adf2d7209fb827ddb6220eb
7852a22b72ead62cfc4a1b1ca32874b3e222f232a991a6d1432313572f534135
78870e56a28616865f1b5f056c4d8798eb8c986ef4247e9cb903c47759f23140
8044a03f7f61ec94fd82991bc7bf3da95e0ae3e890053e3398534d4da395560b
80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8
814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
841ec96a41283cf23db2d69fe67d9beee3e9b222bccfe81ecf6edefc78e92151
8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
8c0e1f95aa09754b10449fd8cd7f2e76d8f232d1038b6cf7454db558ac79962e
8f060e210fa92b0bce82108a417cbf3f4f0ded2dc69a8b293db44da9f4b24c23
91b9b24f0aa59668e4d0a770ee7a294b9baa361a76a20ade8128cd0482a5d805
9714e0f3da25ffe42e0898631d4f3da125d6e3c82061bfa963030ebf8926aaf9
9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f
9bc19ce27e7fe54728be0d4489cf683005fd6f522bbf6391a681d7d2d8d3f190
a03211caa3e15954dc4665b830b25335d3060481040b46bb02d951be62d6c40c
a4d1cf1412729a6ebf14ef0c798f0b9c9dc0ecee9e06e912859e4c53380fb33b
a5dc25b44f66a4a97302932d4e42507562ecd23f893b1669a791662a8ec00542
ac2185eaf27db9d83c2688a55c428a5f18bbe41d8f769c58f41f081b8b17834b
adba1e4ca0f5f76a58da3ee5c24c5a1a0ab75dbdcfee943dda5a53283e7c736e
af64f318f5d1e691c1437d3caa39d375cab4d8d8aca0f127ccb9cd9939226a3c
af770f5afec3e9f10196ea60476a44dde4d80010e680500685b578fee468c8c7
b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8
ba711f4ae1f09fd05735a7b8ec5e0d70d271cf09212431fa192deaed9a324360
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb698b4af30a506bea5e24025b0f742db88461e40a7f9f2f24293ad810bdf842
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
bfb9e92353e3d4999e02a6f01a3551a87686ebf0180baf65b4c961f7061bcf52
c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5
c829514739663b0fbaa1e5b4da63fecddb091258f1f8cb852c5e54e1b3fce9af
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727
d01e29303e11404333dd1293ed958ee09b41203f03b4083a48cc33a66700ffd0
d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453
d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969
d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557
da03f140d305f2abdf496bdd3fad9cfed87a237cf09f6a2edcec58bc5a1f044d
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
deb1aa1c2af7a0f084b58e34c78545593305a87b23f9f6e099849c1ace0c9dd6
e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eeb3ca2cc9fc24486f0af968dd0fcf78b7f81ae4ed162ce4bf98e6df60158636
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5310b6e161788c504b1bc9d90b7dba777c80b10bc02a8b077b37045fe576e5d
f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce
f7ba7e664816f88dde2f3f9b789e427087a5deb8986f708dd02bcfe1c0d8ff55
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fbb6162a3febf0d96b3372dd4f325d2ecd9b9c4e2c6d23e2c2b4eeeb3d7ccdb0
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.securonix.com Open in urlscan Pro 2606:4700:3108::ac42:2b19 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

101 Requests

95 %HTTPS

59 %IPv6

23 Domains

30 Subdomains

30 IPs

6 Countries

1927 kBTransfer

4461 kBSize

20 Cookies

21 Outgoing links

Redirected requests

101 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.securonix.com Open in urlscan Pro
2606:4700:3108::ac42:2b19 Public Scan

Screenshot
Live screenshot

Full Image

101
Requests

95 %
HTTPS

59 %
IPv6

23
Domains

30
Subdomains

30
IPs

6
Countries

1927 kB
Transfer

4461 kB
Size

20
Cookies

101 HTTP transactions
1 data transactions