www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://401.tw/Mr6E
Effective URL:
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Submission: On September 20 via api (September 20th 2024, 1:15:25 pm UTC) from IN — Scanned from JP

Summary HTTP 232 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 74 IPs in 7 countries across 64 domains to perform 232 HTTP transactions. The main IP is 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 115924.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.105.230.106 172.105.230.106	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
59	2406:da18:ad1... 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2600:140b:a00... 2600:140b:a00:383::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	52.197.184.52 52.197.184.52	16509 (AMAZON-02) (AMAZON-02)
1	13.112.211.211 13.112.211.211	16509 (AMAZON-02) (AMAZON-02)
1 1	18.139.230.53 18.139.230.53	16509 (AMAZON-02) (AMAZON-02)
1	63.140.50.191 63.140.50.191	16509 (AMAZON-02) (AMAZON-02)
6	104.19.148.8 104.19.148.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	23.50.118.161 23.50.118.161	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.32.225.140 23.32.225.140	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.124.133.154 34.124.133.154	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2404:6800:400... 2404:6800:4004:818::2008	15169 (GOOGLE) (GOOGLE)
2	38.133.127.191 38.133.127.191	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2600:140b:1c0... 2600:140b:1c00:39::1732:761f	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	76.223.9.105 76.223.9.105	16509 (AMAZON-02) (AMAZON-02)
4	3.37.33.195 3.37.33.195	16509 (AMAZON-02) (AMAZON-02)
1	63.140.50.233 63.140.50.233	16509 (AMAZON-02) (AMAZON-02)
6	142.251.42.136 142.251.42.136	15169 (GOOGLE) (GOOGLE)
2	2404:6800:400... 2404:6800:4004:823::200e	15169 (GOOGLE) (GOOGLE)
2	2400:52e0:150... 2400:52e0:1501::1193:1	200325 (BUNNYCDN) (BUNNYCDN)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:bdf::46 2620:1ec:bdf::46	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	74.121.140.211 74.121.140.211	30419 (PAEDAE-INC) (PAEDAE-INC)
1 4	142.251.42.162 142.251.42.162	15169 (GOOGLE) (GOOGLE)
3	2404:6800:400... 2404:6800:4004:825::2002	15169 (GOOGLE) (GOOGLE)
1 3	172.217.26.230 172.217.26.230	15169 (GOOGLE) (GOOGLE)
1	172.217.161.34 172.217.161.34	15169 (GOOGLE) (GOOGLE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 4	142.251.222.36 142.251.222.36	15169 (GOOGLE) (GOOGLE)
4	142.250.76.131 142.250.76.131	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
1	54.69.255.140 54.69.255.140	16509 (AMAZON-02) (AMAZON-02)
1	151.101.228.157 151.101.228.157	54113 (FASTLY) (FASTLY)
1 2	103.43.90.21 103.43.90.21	29990 (ASN-APPNEX) (ASN-APPNEX)
1 3	103.43.90.179 103.43.90.179	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:275... 2600:9000:2751:ac00:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
19 25	34.124.209.251 34.124.209.251	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2600:9000:27a... 2600:9000:27af:d400:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	104.18.41.104 104.18.41.104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	74.118.186.107 74.118.186.107	6336 (TURN-US-ASN) (TURN-US-ASN)
1 2	52.223.2.229 52.223.2.229	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4216:2684:b32f:7d35:8ca4	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	57.180.73.140 57.180.73.140	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:26f... 2600:9000:26f2:400:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	3.164.110.92 3.164.110.92	16509 (AMAZON-02) (AMAZON-02)
2 2	2600:1901:0:8... 2600:1901:0:8eee::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	23.106.127.57 23.106.127.57	59253 (LEASEWEB-...) (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD.)
1 2	34.229.3.43 34.229.3.43	14618 (AMAZON-AES) (AMAZON-AES)
1	52.21.56.232 52.21.56.232	14618 (AMAZON-AES) (AMAZON-AES)
1 2	23.36.17.70 23.36.17.70	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	13.228.141.56 13.228.141.56	16509 (AMAZON-02) (AMAZON-02)
1 2	54.71.108.129 54.71.108.129	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	52.46.128.147 52.46.128.147	16509 (AMAZON-02) (AMAZON-02)
1 1	142.250.196.98 142.250.196.98	15169 (GOOGLE) (GOOGLE)
1 2	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
3 3	142.250.196.130 142.250.196.130	15169 (GOOGLE) (GOOGLE)
2	157.240.31.5 157.240.31.5	32934 (FACEBOOK) (FACEBOOK)
1	172.67.163.237 172.67.163.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	100.20.58.101 100.20.58.101	16509 (AMAZON-02) (AMAZON-02)
1 5	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:140b:1a0... 2600:140b:1a00:4::17c1:b893	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.48.36.94 13.48.36.94	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f10... 2a03:2880:f10f:187:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	35.85.106.161 35.85.106.161	16509 (AMAZON-02) (AMAZON-02)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8 9	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 3	18.182.162.20 18.182.162.20	16509 (AMAZON-02) (AMAZON-02)
1	35.81.162.201 35.81.162.201	16509 (AMAZON-02) (AMAZON-02)
1	52.10.121.135 52.10.121.135	16509 (AMAZON-02) (AMAZON-02)
1 1	207.65.34.80 207.65.34.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
232	74

1 172.105.230.106 (Tokyo, Japan) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1884-106.members.linode.com

401.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

59 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2600:140b:a00:383::1e80 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.197.184.52 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-197-184-52.ap-northeast-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.112.211.211 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-112-211-211.ap-northeast-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.139.230.53 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-139-230-53.ap-southeast-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.50.191 (United States)

ASN16509 (AMAZON-02, US)

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.148.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 23.50.118.161 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-50-118-161.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.32.225.140 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-32-225-140.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.124.133.154 (Singapore, Singapore)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 154.133.124.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:818::2008 (Australia)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.133.127.191 (Sacramento, United States)

ASN22075 (AS-OUTBRAIN, US)

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1c00:39::1732:761f (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.9.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.37.33.195 (Incheon, Korea, Republic Of)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-37-33-195.ap-northeast-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.50.233 (United States)

ASN16509 (AMAZON-02, US)

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.42.136 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s45-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:823::200e (Australia)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1501::1193:1 (Japan)

ASN200325 (BUNNYCDN, SI)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1247 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::46 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webtracker.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.121.140.211 (Reston, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.42.162 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s46-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:825::2002 (Australia)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.26.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s51-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.161.34 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s23-in-f2.1e100.net

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.222.36 (Farmingdale, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt13s72-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.76.131 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: kix07s06-in-f3.1e100.net

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.69.255.140 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-69-255-140.us-west-2.compute.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.228.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.43.90.21 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 597.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.43.90.179 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2751:ac00:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 34.124.209.251 (Singapore, Singapore) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 251.209.124.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:27af:d400:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.41.104 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.118.186.107 (Serangoon New Town, Singapore)

ASN6336 (TURN-US-ASN, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.2.229 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ade9ecc7904667038.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4216:2684:b32f:7d35:8ca4 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 57.180.73.140 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-57-180-73-140.ap-northeast-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26f2:400:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.164.110.92 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-164-110-92.nrt12.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.106.127.57 (Singapore, Singapore) 1 redirects

ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG)

sync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.229.3.43 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.21.56.232 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-56-232.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.36.17.70 (Tokyo, Japan) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-17-70.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.228.141.56 (Singapore, Singapore) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-228-141-56.ap-southeast-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.71.108.129 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-71-108-129.us-west-2.compute.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.128.147 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.196.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s35-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.158.64 (Singapore, Singapore) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.196.130 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.31.5 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-nrt1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.163.237 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 100.20.58.101 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-100-20-58-101.us-west-2.compute.amazonaws.com

100.20.58.101	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.117.77.79 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1a00:4::17c1:b893 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.48.36.94 (Stockholm, Sweden)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-48-36-94.eu-north-1.compute.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f10f:187:face:b00c:0:25de (Tokyo, Japan)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.85.106.161 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-85-106-161.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.223.40.198 (United States) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.182.162.20 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.162.201 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-162-201.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.10.121.135 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-10-121-135.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 207.65.34.80 (United States) 1 redirects

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 115924 metrics.fortinet.com — Cisco Umbrella Rank: 284311	5 MB
27	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4944 i.simpli.fi — Cisco Umbrella Rank: 4294 um.simpli.fi — Cisco Umbrella Rank: 934	15 KB
22	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 452	151 KB
15	6sc.co j.6sc.co — Cisco Umbrella Rank: 5691 c.6sc.co — Cisco Umbrella Rank: 7155 ipv6.6sc.co — Cisco Umbrella Rank: 5832 b.6sc.co — Cisco Umbrella Rank: 3516	22 KB
14	doubleclick.net 5 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 td.doubleclick.net — Cisco Umbrella Rank: 189 ad.doubleclick.net — Cisco Umbrella Rank: 153 cm.g.doubleclick.net — Cisco Umbrella Rank: 284 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 296118	9 KB
10	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2506 tracking.crazyegg.com — Cisco Umbrella Rank: 4420	79 KB
9	adsrvr.org 8 redirects match.adsrvr.org — Cisco Umbrella Rank: 382 insight.adsrvr.org — Cisco Umbrella Rank: 954	7 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	726 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1751	14 KB
5	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 270	5 KB
5	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3422 tr.outbrain.com — Cisco Umbrella Rank: 3354 wave.outbrain.com — Cisco Umbrella Rank: 3410	10 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 256 fortinet.demdex.net — Cisco Umbrella Rank: 308668	3 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 px4.ads.linkedin.com — Cisco Umbrella Rank: 6795	2 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 5047 px.mountain.com — Cisco Umbrella Rank: 5170 gs.mountain.com — Cisco Umbrella Rank: 9611	11 KB
4	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 26138	256 B
4	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3	216 B
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1085	2 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 932	849 B
3	t.co t.co — Cisco Umbrella Rank: 834	2 KB
3	crwdcntrl.net 2 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 989 sync.crwdcntrl.net — Cisco Umbrella Rank: 915	799 B
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 58667 tracking.contanuity.com — Cisco Umbrella Rank: 19503	1 KB
3	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 299240 pixels.argusplatform.com — Cisco Umbrella Rank: 299605 webtracker.argusplatform.com — Cisco Umbrella Rank: 306518	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 28371 ibc-flow.techtarget.com — Cisco Umbrella Rank: 25060	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 361	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 106	4 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 178	71 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 526	501 B
2	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 414	3 KB
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 367	2 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 476	587 B
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 943	895 B
2	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 1278 tags.bluekai.com — Cisco Umbrella Rank: 853	777 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 2052	3 KB
2	smartadserver.com 1 redirects sync.smartadserver.com — Cisco Umbrella Rank: 1446	1 KB
2	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2630	903 B
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 1035	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 544 d.agkn.com — Cisco Umbrella Rank: 777	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 467	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 424	969 B
2	connatix.com 1 redirects capi.connatix.com — Cisco Umbrella Rank: 855	536 B
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 56454	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6393 api.omappapi.com — Cisco Umbrella Rank: 6510	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8883	710 B
1	pubmatic.com 1 redirects simage2.pubmatic.com — Cisco Umbrella Rank: 967	526 B
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 12708	319 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 257361	149 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 782	14 KB
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3837	12 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 91	23 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1589	421 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6782	175 B
1	1rx.io sync.1rx.io — Cisco Umbrella Rank: 509	99 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 676	543 B
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 200853	443 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 875	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 314	15 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 2662	711 B
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 33929	18 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 295805	831 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1463	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 491	305 B
1	401.tw 1 redirects 401.tw	297 B
232	64

	Domain	Requested by
59	www.fortinet.com	www.fortinet.com
25	um.simpli.fi	19 redirects
22	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
12	b.6sc.co	www.fortinet.com
8	match.adsrvr.org	7 redirects
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
6	script.crazyegg.com	www.fortinet.com script.crazyegg.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	ml314.com	1 redirects www.fortinet.com ml314.com
4	www.google.co.jp	www.fortinet.com
4	www.google.com	1 redirects www.fortinet.com
4	td.doubleclick.net	www.googletagmanager.com
4	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
4	tracking.crazyegg.com	script.crazyegg.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	ps.eyeota.net	2 redirects
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	analytics.twitter.com
3	t.co
3	cm.g.doubleclick.net	3 redirects
3	ib.adnxs.com	1 redirects
3	bat.bing.com	assets.adobedtm.com bat.bing.com www.fortinet.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	us-u.openx.net	1 redirects
2	pixel.rubiconproject.com	1 redirects
2	s.amazon-adsystem.com	1 redirects
2	idsync.rlcdn.com	2 redirects
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	loadm.exelator.com	1 redirects
2	sync.smartadserver.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	pixel.tapad.com	1 redirects
2	eb2.3lift.com	1 redirects
2	capi.connatix.com	1 redirects
2	secure.adnxs.com	1 redirects
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	www.google-analytics.com	www.googletagmanager.com
2	epsilon.6sense.com	j.6sc.co
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	simage2.pubmatic.com	1 redirects
1	tags.bluekai.com	1 redirects
1	insight.adsrvr.org	1 redirects
1	px.steelhousemedia.com
1	gs.mountain.com	px.mountain.com
1	sync.crwdcntrl.net	1 redirects
1	px4.ads.linkedin.com
1	6033413.global.siteimproveanalytics.io
1	snap.licdn.com	www.fortinet.com
1	siteimproveanalytics.com	assets.adobedtm.com
1	www.googleadservices.com	1 redirects
1	stags.bluekai.com
1	sync.bfmio.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.1rx.io
1	s.ad.smaato.net	1 redirects
1	tags.inzynk.io	assets.adobedtm.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	webtracker.argusplatform.com	tmp.argusplatform.com
1	i.simpli.fi	tag.simpli.fi
1	tracking.contanuity.com	abm-tracking.demandscience.com www.fortinet.com
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	pixels.argusplatform.com	tmp.argusplatform.com
1	ad.doubleclick.net	www.fortinet.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	a.opmnstr.com	assets.adobedtm.com
1	metrics.fortinet.com	www.fortinet.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	401.tw	1 redirects
232	91

This site contains links to these domains. Also see Links.

Domain
github.com
nvd.nist.gov
geoserver.org
www.cisa.gov
www.fortiguard.com
attack.mitre.org
training.fortinet.com
www.linkedin.com
www.twitter.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R11	`2024-07-03` - `2024-10-01`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-04-04` - `2025-05-04`	a year	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-21` - `2025-07-20`	a year	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
a.opmnstr.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
a.omappapi.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
omappapi.com WE1	`2024-08-14` - `2024-11-12`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-08-14` - `2024-11-12`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.co.jp WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
pixels.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-08` - `2025-03-08`	6 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E6	`2024-08-15` - `2024-11-13`	3 months	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
webtracker.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-29` - `2024-09-27`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-08-19` - `2024-11-17`	3 months	crt.sh
t.co E6	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-02` - `2024-10-31`	a year	crt.sh
100.20.58.101 Sectigo RSA Domain Validation Secure Server CA	`2024-05-17` - `2025-05-22`	a year	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M03	`2024-09-02` - `2025-10-01`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: 013D8B86E3A1584700A793D8B8129058
Requests: 223 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 3CFF065AC0EAEDBDA7DBE648B4C50DB3
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1726838115578&cv=11&fst=1726838115578&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 5BDDAC6BA0ABBC3E12B522175009C54C
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=997501737.1726838115;ps=1;pcor=1713281419;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: 2A8CA378408AD3720ACB6722266B8129
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1726838115720&cv=11&fst=1726838115720&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 72347FC4512C96516B0CB61BFF6BF28E
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1726838115803&cv=11&fst=1726838115803&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: F8BF4773B935CC6C2219EB57A8D206DA
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=COeX1aTN0YgDFcFUDwIdchoCXg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5786336105875.167
Frame ID: DE0C32C438C0AB6A7C9FAE8E993CC0DC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401 | FortiGuard Labs

Page URL History Show full URLs

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

232
Requests

86 %
HTTPS

27 %
IPv6

64
Domains

91
Subdomains

74
IPs

7
Countries

6824 kB
Transfer

10689 kB
Size

115
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/geoserver/geoserver
Title: open-source software

Search URL Search Domain Scan URL

URL: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
Title: advisory

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36401
Title: CVE-2024-36401

Search URL Search Domain Scan URL

URL: https://geoserver.org/announcements/vulnerability/2024/06/18/geoserver-2-25-2-released.html
Title: addressed

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/alerts/2024/07/15/cisa-adds-one-known-exploited-vulnerability-catalog
Title: added

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56197
Title: IPS signature

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0096/
Title: APT41

Search URL Search Domain Scan URL

URL: https://github.com/fatedier/frp
Title: Fast Reverse Proxy

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0059/
Title: Magic Hound

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Title: Fox Kitten

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Title: Volt Typhoon

Search URL Search Domain Scan URL

URL: https://training.fortinet.com/local/staticpage/view.php?page=fcf_cybersecurity
Title: Fortinet Certified Fundamentals (FCF) in Cybersecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 68

https://cm.everesttech.net/cm/dd?d_uuid=84513195557227243113526244154705204691 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11YgAAAJK4QAN8

Request Chain 149

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838116237 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838116237&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AAF_7k7N2usAABTiiMx9tQ

Request Chain 169

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 170

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 173

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=BA538520521648E9919712AEE5D583A8 HTTP 302
https://capi.connatix.com/us/pixel?puid=4fb91121a4&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString} HTTP 302
https://capi.connatix.com/us/pixel?puid=4fb91121a4&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true

Request Chain 174

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/BA538520521648E9919712AEE5D583A8

Request Chain 175

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=BA538520521648E9919712AEE5D583A8&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=BA538520521648E9919712AEE5D583A8&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 176

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=BA538520521648E9919712AEE5D583A8

Request Chain 177

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=BA538520521648E9919712AEE5D583A8 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=BA538520521648E9919712AEE5D583A8

Request Chain 178

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=BA538520521648E9919712AEE5D583A8 HTTP 302
https://d.agkn.com/pixel/10751/?che=1726838118098&ip=31.204.145.170&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D232883305011003801845 HTTP 302
https://um.simpli.fi/aa_px?sk=232883305011003801845 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 179

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BA538520521648E9919712AEE5D583A8 HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BA538520521648E9919712AEE5D583A8&ckls=true&ci=B4lqTSwp81&nc=false&trid=-2053411095

Request Chain 182

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=BA538520521648E9919712AEE5D583A8;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=BA538520521648E9919712AEE5D583A8;mimetype=img;sr HTTP 302
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid] HTTP 302
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

Request Chain 183

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=BA538520521648E9919712AEE5D583A8&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=BA538520521648E9919712AEE5D583A8&j=0&xl8blockcheck=1

Request Chain 185

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=BA538520521648E9919712AEE5D583A8

Request Chain 186

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=BA538520521648E9919712AEE5D583A8

Request Chain 187

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=BA538520521648E9919712AEE5D583A8 HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=BA538520521648E9919712AEE5D583A8

Request Chain 188

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=BA538520521648E9919712AEE5D583A8 HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=BA538520521648E9919712AEE5D583A8&dnr=1

Request Chain 189

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=BA538520521648E9919712AEE5D583A8 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogQkE1Mzg1MjA1MjE2NDhFOTkxOTcxMkFFRTVENTgzQTgQABoNCObqtbcGEgUI6AcQAEIASgA HTTP 307
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=06367349 HTTP 302
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=06367349&dcc=t

Request Chain 190

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838117250&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMI1uLUpM3RiAMVNKHpBR2UTwJTMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMI1uLUpM3RiAMVNKHpBR2UTwJTMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnf_E8Hb7roaUJwA_-pPoRKquCQSJ2ZznZ7-GZHUk0qqxGRrRKY&random=3732702806 HTTP 302
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMI1uLUpM3RiAMVNKHpBR2UTwJTMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnf_E8Hb7roaUJwA_-pPoRKquCQSJ2ZznZ7-GZHUk0qqxGRrRKY&random=3732702806&ipr=y

Request Chain 192

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=BA538520521648E9919712AEE5D583A8

Request Chain 193

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BA538520521648E9919712AEE5D583A8&expires=365

Request Chain 194

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=BA538520521648E9919712AEE5D583A8 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BA538520521648E9919712AEE5D583A8

Request Chain 195

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEEyD1UlrsuVKyoRj6oByeCQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=BA538520521648E9919712AEE5D583A8 HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 196

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5786336105875.167 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=COeX1aTN0YgDFcFUDwIdchoCXg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5786336105875.167

Request Chain 217

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838119182&li_adsId=81af5af2-7bf2-4248-89d5-2a8b908c0fcf&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838119182&li_adsId=81af5af2-7bf2-4248-89d5-2a8b908c0fcf&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQItcZON_FKCpQAAAZIPkpuQboQqNtUaSymaU89x0FanYL1u0DFj3EsbW2X510gv5XNvQQ

Request Chain 219

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=

Request Chain 220

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144418421506066 HTTP 302
https://ml314.com/csync.ashx?fp=7eb9da8c76d7741ca1f47ea6c0529648&eid=50146&person_id=3647144418421506066

Request Chain 221

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2RFrRYqDtPICaqzHzAH1L2KW-gIDwPXMaQdnt9k9RMYQ&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 227

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=62de3d2e-7752-11ef-ae8d-1df8c297f37c&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=a5773930-db33-43ae-8f4c-c85a5da03847&shguid=62de3d2e-7752-11ef-ae8d-1df8c297f37c

Request Chain 228

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YTU3NzM5MzAtZGIzMy00M2FlLThmNGMtYzg1YTVkYTAzODQ3&gdpr=0&gdpr_consent=&ttd_tdid=a5773930-db33-43ae-8f4c-c85a5da03847 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=a5773930-db33-43ae-8f4c-c85a5da03847&google_gid=CAESEDlOYno0e1--BsMseH9AsQ8&google_cver=1 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://tags.bluekai.com/site/5386?id=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=a5773930-db33-43ae-8f4c-c85a5da03847&r=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dpubmatic HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic

232 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

https://401.tw/Mr6E
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

103 KB
29 KB

215ms
75ms

Document
text/html

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 86698
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 27960
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Fri, 20 Sep 2024 13:14:57 GMT
ETag: "19b93-62278a4ad0fc7-gzip"
Last-Modified: Thu, 19 Sep 2024 13:10:14 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: m4f31KiRiV7JuIGiQQZvTdU4mSHcFPxCDaUa_lsHNNFIhvNQNFjgpQ==
X-Amz-Cf-Pop: SIN2-P4
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher1uswest1-28559594
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 142
Content-Type: text/html; charset=utf-8
Date: Fri, 20 Sep 2024 13:15:13 GMT
Location: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Server: nginx/1.26.1

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 204ms
72ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 330518
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: YW14gxE2JOUkzZQunSHwIdRD7w6WWXwYNTvYsmizelQQ8r6g6VeM8w==
Date: Mon, 16 Sep 2024 17:27:27 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 211ms
75ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 330479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7xXuOODFon9ex4ZqCxe36-TacsyW-CeSDaq9vxytqbZbJZoRzL4jgA==
Date: Mon, 16 Sep 2024 17:27:28 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 127ms
72ms Stylesheet
text/css 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58998583c0-gzip"
Age: 5163991
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: W53QSFFWUmpVASds8N852vpuaSe_voUnY2gnbmJC7K4AlIwV03b8Jw==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 21:00:07 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 57ms
45ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCD8180F629235
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 47107
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: application/javascript
last-modified: Wed, 18 Sep 2024 19:28:22 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 6758b5e5-201e-0098-0fc4-0a1db5000000
cf-ray: 8c6215409f6ed4cc-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 215ms
79ms Image
image/svg+xml 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 34042432
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: nILC4t0OX9WpeV2x6Jft2ylvIfwsbTSANwsVDuxzMBhlLarQbbr_mQ==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 215ms
73ms Image
image/jpeg 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 26854849
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: CF8WcG_6HGDEZ5ONDDv_db41NHG7MSPzX2_CU0UEF3n9_2uqKRfsCw==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 78ms
77ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 5163989
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: nhABJPi6OirQ96BWiOceSjqnpE9J2rDs7y2KecsNmmGvzxYUgXlPrw==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 43ms
37ms XHR
application/x-javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 74517
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:15:13 GMT
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: c21183be-301e-00a5-5054-cda893000000
cf-ray: 8c6215418b24f6c1-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK geoserver-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 370 KB
372 KB 80ms
79ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/geoserver-hero.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "5c8ee-621505f67c380"
Age: 1296302
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: TBlcYdiqjJGbGQLJkAd0aW8t2w6Qd-HD7oN5_txlZXkbHgM9ndgYiA==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 19:42:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 71cf035a55e299e5d12b1bf6482e945e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 379118
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK chavecloak-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 37 KB
39 KB 71ms
70ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/chavecloak-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "9490-611dcced7f240"
Age: 14248941
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DcMpXxp-2T09HhtGOPwMXiWhoaPeXMFWwre0VFco717aumEqsL_YpQ==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 21 Feb 2024 04:32:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 38032
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK scrubcrypt-24-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 43 KB
44 KB 71ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/scrubcrypt-24-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "ab05-6155cc8f5f240"
Age: 14245015
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ABiKnQTgAZ46_MutTM--wgEA_46tGwPjVh_UjVgOeT2NqeutiYU1fw==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Fri, 05 Apr 2024 17:28:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 43781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK lumma-variant-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 46 KB
48 KB 73ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/lumma-variant-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "b8c6-60dff3ae26100"
Age: 22103908
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: m8lzREs8vWfyvtXIaunJKUgf9mtymmJ87bliHEQyCjrmiaBiwBktTw==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Tue, 02 Jan 2024 23:55:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47302
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 74ms
74ms Font
application/octet-stream 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 330553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fTtGvJtiOkmgYwzeYuvtzGpXvz19Tr3uCr5JRkUfYp3VEl5_eeeS5A==
Date: Mon, 16 Sep 2024 17:27:32 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
305 B 66ms
48ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8c6215432f036831-NRT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK fig01-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/ 61 KB
62 KB 75ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/fig01-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f3de-62153bab9b9c0"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: JLWBgZdas724Qtm6zL5QfNp9cBCtgW5YJ3mjAcv-VHPbiG-7c66LVA==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 62430
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK fig02-geoserver-script-file-remote-sh.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/ 449 KB
451 KB 77ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/fig02-geoserver-script-file-remote-sh.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "70532-62153d1418c40"
Age: 1284558
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2L3IeGEtppRghia3CR9ICpPpNbhwTG3gid9pX6FuA8Is2COITZ9W7g==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:48:57 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 460082
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig03-geoserver-gorevese.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/ 50 KB
51 KB 84ms
81ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/fig03-geoserver-gorevese.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "c6c1-62153d2a08000"
Age: 1284630
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: frWfXCIltZKWi8i8qCP58dCTxfdgIYp0SugoPsYp3_xvnOO2xp4tcQ==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50881
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig04-geoserver-goreverse-log.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/ 265 KB
267 KB 99ms
94ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/fig04-geoserver-goreverse-log.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "42511-62153ba3fa7c0"
Age: 1284630
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _ga5W10GeGvDDiyhVVAqrrYS-X2CGC5ANL0meN2mXCUHfDCt8sGnLw==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 271633
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig05-geoserver-goreverse-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/ 75 KB
76 KB 77ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/fig05-geoserver-goreverse-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "12a2b-62153b96a0840"
Age: 1284558
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: v-tcv90d5ENmDq4US6ZKSsAw3ZDFRdZj38Gwt7NcXmtzANcm8LQTdA==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 76331
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig06-geoserver-script-file-d.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/ 185 KB
187 KB 75ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/fig06-geoserver-script-file-d.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2e589-62153b90e7ac0"
Age: 1283678
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ddiXLASbGR2GiOeDV6NhRxswEW--fMq1ZmzppHWf6POxoG_VBP5Pow==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 71cf035a55e299e5d12b1bf6482e945e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 189833
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig07-geoserver-creating-folders.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/ 113 KB
115 KB 73ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/fig07-geoserver-creating-folders.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1c505-62153bbfa2900"
Age: 1284629
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fGT3rCxJ81z-4hmzxgSG_hQSVRVW90ew7wd7Tik9Ryl1JfUoXlCPFQ==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115973
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig08-geoserver-xor-decoded-0x60.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/ 115 KB
117 KB 80ms
79ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/fig08-geoserver-xor-decoded-0x60.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1cd07-6215774c1e740"
Age: 1284559
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NpKS3gaMtfMZgskg2bAkVOqdUlYofixFAnVG15oHfrSD-XIJzBra5w==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:09:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 71cf035a55e299e5d12b1bf6482e945e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 118023
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig09-geoserver-saved-decoded-files.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/ 33 KB
35 KB 80ms
80ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/fig09-geoserver-saved-decoded-files.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "85a6-62153be5c8300"
Age: 15171
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Mm-uB9W0BvipiHwKMtNWCgE6k75PvuApVpEjeXd2BmetyAaz7_-OCQ==
Date: Fri, 20 Sep 2024 09:02:23 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 34214
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig10-geoserver-xor-decoded-0x89.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/ 131 KB
133 KB 78ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/fig10-geoserver-xor-decoded-0x89.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20cd5-62153bf50a700"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Qj5RT7KZJ1q3hF8ph54V7i06K0Tonv192FXeVDBF7IHbpUxJdF4idw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:56 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 134357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig11-geoserver-decrypted-configuration-chacha20.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/ 41 KB
42 KB 76ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/fig11-geoserver-decrypted-configuration-chacha20.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "a2f9-62153c0dd6180"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: iSO4EvJgMTKeqO3JJ87RnltIbT2YikxDLOXWUsZETe2FXXNS_mf_2A==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41721
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig12-geoserver-encrypted-binary.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/ 160 KB
161 KB 93ms
92ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/fig12-geoserver-encrypted-binary.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "27ee7-62153c2d4ebc0"
Age: 1284629
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: bzr2_X-YKDANTHNTvMrfnDlyp89gl6nnSxNGHZUKXA3gUuudaLfOEw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 71cf035a55e299e5d12b1bf6482e945e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 163559
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig13-geoserver-decrypted-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/ 121 KB
122 KB 84ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/fig13-geoserver-decrypted-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e310-62153c3213700"
Age: 1284559
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5JA3nq7-PJ_njFI4NVmLBUv1zwb4sMJlPOjHk6YLwuMddyELSUZzSg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 123664
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig14-geoserver-packet-capture-c2-connection.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/ 138 KB
140 KB 77ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/fig14-geoserver-packet-capture-c2-connection.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "229ef-62153c4249d40"
Age: 1284558
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: KSoqG_P9G5BgizhzV6GpFgSgpO7hoSbSl5Dv7bolK4ZVy5_Yyto1Lw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 141807
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig15-geoserver-c2-communication.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/ 71 KB
73 KB 76ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/fig15-geoserver-c2-communication.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11cc6-62153c518c140"
Age: 1284629
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Kp32WJaMOw3SxI6OEd-_HVQUcZvIpJ3SGUPpO7styOHIjtd5e8UnJA==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 72902
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig16-geoserver-fpr-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/ 129 KB
130 KB 73ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/fig16-geoserver-fpr-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20403-62157778f1100"
Age: 1284629
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Tk63Xo4QkY4_VGJ7iwT0MZkByntzo3wII3seoUNNoKCSNjFjynC7Gg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 132099
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig17-geoserver-packet-capture-fpr.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/ 106 KB
108 KB 72ms
70ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/fig17-geoserver-packet-capture-fpr.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1a98f-6215778927740"
Age: 1283678
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VQ7s8rTOoQMNop_ndt_cRVjsUrxeJJ8YLQ_ObvKLKv0AGgVd0AKAcw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 108943
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig18-geoserver-telemetry.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/ 93 KB
94 KB 81ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/fig18-geoserver-telemetry.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1725d-62153c89d0600"
Age: 1284628
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Pxgs2pfjfX9KGDH9iKWx-dhNMTai0EhwosTi9WsUt-y_OayQIVQzBw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:46:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 94813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig19-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/ 117 KB
119 KB 72ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/fig19-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d5d5-62153ca854e00"
Age: 1284628
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VCHVfybf0XzVWQmIaOMY-IGqm0cT_KvFPvzdKPHynUAxDbnoyh_n5g==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig20-geoserver-xor-decoded-function.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/ 30 KB
32 KB 79ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/fig20-geoserver-xor-decoded-function.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "794f-62153cb797200"
Age: 24806
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Qyh5xpAqfpRKJO5RIqWsIEcIvSFiGdoSH6oGymUcPwMA-vVOuew3AQ==
Date: Fri, 20 Sep 2024 06:21:47 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31055
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig21-geoserver-decoded-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/ 18 KB
19 KB 72ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/fig21-geoserver-decoded-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4702-62153d4f397c0"
Age: 1284628
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: TgpAtVqlmewjNmmACj3tBfPsjXWp-KD3PoZEcIJqROU4WFGDBbjYqQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18178
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig22-geoserver-execution-msg.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/ 26 KB
28 KB 75ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/fig22-geoserver-execution-msg.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "69e7-62153d6434940"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: J3WpP7sKxwvEpX44EadvzAVVBZv2F9zCCM4jBGnGC3yin4iIrQ81HQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27111
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig23-geoserver-hard-coded-payload.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/ 117 KB
119 KB 78ms
78ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/fig23-geoserver-hard-coded-payload.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d57e-62153d718e8c0"
Age: 1284627
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5ZhY20oU38g2VxowDnH3WQIMmVmxs60ZwjJZeMe_KPXk2UkV6iPj-g==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120190
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig24-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/ 154 KB
155 KB 74ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/fig24-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26815-62153d9107300"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: FJRhasRfYhVLtyqC3aJnFfOjHzBbl8k2Ufwdo5PtGnHIGtdFmGdGZg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 157717
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig25-geoserver-significant-string.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/ 27 KB
28 KB 72ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/fig25-geoserver-significant-string.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6a84-62153da13d940"
Age: 1284142
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: k3dg1dbxyK-9G-_DMU6cNv33C2GTN_tvO6SIPt54yznFZUJ8sAI_qg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27268
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig26-geoserver-continually-connecting-c2-server.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/ 155 KB
156 KB 72ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/fig26-geoserver-continually-connecting-c2-server.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26a3d-62153dc486c80"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: KqbGLrpVQaOX12qkCNH6COix1jqK-cSSk43JMRxYCOLc9vEWRrg3Qg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 158269
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig27-geoserver-ddos-attack-methods.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/ 64 KB
65 KB 70ms
70ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/fig27-geoserver-ddos-attack-methods.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "fe15-62153dd4bd2c0"
Age: 1284626
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: h9hM2xBArhxmbZzbHoVojgqFcvCLVcjzB2Mmpgp7nyI-G5oIyhnOfg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65045
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig28-geoserver-creating-service.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/ 60 KB
61 KB 74ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/fig28-geoserver-creating-service.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f051-62153de6dbd80"
Age: 15168
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 16uVa87VU0bq2_xfFJRK_SknudWkCBVaWnost2DQMsFksdTHX-4WJQ==
Date: Fri, 20 Sep 2024 09:02:26 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:38 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 61521
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig29-geoserver-command-execution.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/ 122 KB
124 KB 71ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/fig29-geoserver-command-execution.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e99b-62153df7123c0"
Age: 1284558
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: GyifuGm1hPDUWaxe2bGCjLlmlebMx2igvYHA1VxvHb6C83WEsnFeyg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 125339
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig30-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/ 79 KB
80 KB 72ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/fig30-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "13af8-62153e06547c0"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: OGi97RMiKZ2mHYc1MqMATQ3IMTVHJCvyAQojdJ6lAxM_BbZdQPD63w==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:53:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80632
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig31-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/ 198 KB
199 KB 73ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/fig31-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "31604-62153e3603840"
Age: 1284557
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: IUYd2ew-xv5pApkV7yHVVc3jTRXrGejiQC4EGrpTS5d-HvJq_eZSkg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 202244
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig32-geoserver-download-persistence.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/ 85 KB
87 KB 70ms
70ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/fig32-geoserver-download-persistence.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "155fb-62153e4a0a780"
Age: 1284625
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: lWJhK_kxkXltRjcZCCaocywVd-7_zT30Qr5UgfDsUxUl5FgqttXzzA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 87547
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig33-geoserver-coin-miner-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/ 108 KB
110 KB 73ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/fig33-geoserver-coin-miner-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1b0fc-62153e5ff9b40"
Age: 1284557
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: crN_41gC-jBb4E-CfFJ22b1iTasQpbeauZrirzpuYCkCmv-KaNDyMQ==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 110844
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig34-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/ 69 KB
70 KB 74ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/fig34-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11459-62153e6d53ac0"
Age: 1284556
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: pVm39iT0FCiHwtLvX1Qxuc4JWYtQCJQPksf-hiuc-WoeZZalu3gJFw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 70745
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig35-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/ 94 KB
96 KB 73ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/fig35-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "178b4-62157992d0600"
Age: 1284557
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NNA9ECc8z8vew5yCJQ8UuR3hM-7cMXI0z6rdPGBh309x4QfzoL-hWA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:19:36 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96436
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig36-geoserver-config-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/ 27 KB
28 KB 82ms
81ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/fig36-geoserver-config-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6c22-62153e8bd82c0"
Age: 1284557
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: HKX_tdIGSblc7zKmuFf6It9Zf4w4lE0Gpfi8u7ro5zBnVmFcx-748w==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27682
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig37-geoserver-coin-miner.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/ 144 KB
145 KB 75ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/fig37-geoserver-coin-miner.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "23eb3-62153e9df6d80"
Age: 1284623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: sAwQ_SWGkvPrzDZwTtDhUjgFTKuGpzYnTJj7bA8gbIdCEUNHx5hycQ==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 147123
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig38-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/ 175 KB
176 KB 92ms
92ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/fig38-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2bb8d-62153eaf21600"
Age: 1283678
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: OBroniWNHKW6S3m2DbinJvb7JGHjF1xcwe81YbDP5uQ_u5zoB7Ip_g==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 179085
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig39-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/ 74 KB
75 KB 74ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/fig39-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "127f9-62153ec604c00"
Age: 1284557
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zNgFdYqLhG3pkYmGxfC9T3VWmtB6xKSGzv6q17Ai2l6sdT3ynzbRHg==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 75769
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig40-geoserver-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/ 127 KB
128 KB 76ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/fig40-geoserver-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1fbf5-62153ee0b8b00"
Age: 1283678
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: cywWKZuRJp8MlAAqh_pG1ysmc19X-hdu0mzhjtN5RHAlxDteowi1xQ==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 130037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig41-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/ 53 KB
55 KB 78ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/fig41-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "d499-62153eef06cc0"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -HKfsBns_n1unazRiUD4E0l1gOBUDw0r83UqlbDEId8Ayu_VB397Hg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 54425
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig42-geoserver-fraudulent-site.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/ 64 KB
66 KB 78ms
78ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/fig42-geoserver-fraudulent-site.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "100f5-62153eff3d300"
Age: 1283678
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mDscFz87xmzDVGA5tD-PncMKlzDzS7jVV1eJK8yZr0TAmnDGK6WDYw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 92e43f5e08d92192931cf833ba935f62.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig43-geoserver-script-file-cron.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/ 35 KB
36 KB 78ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/fig43-geoserver-script-file-cron.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "8ba4-62153f2286640"
Age: 1283679
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Si5aEvLoP_nV5-eRid2fsv0wmETKeG8jNYLw5NqxBdgHQFrI_7JGaw==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35748
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig44-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/ 26 KB
27 KB 82ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/fig44-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6813-62153f1dc1b00"
Age: 1284555
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: alHymY_bMuCxhprDxJjS0QmEwZrNZjmzxik9ukzulEPgM0syg5TQOw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 96284f61084e7118716cb8c5c34dd7a0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 26643
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig45-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/ 30 KB
31 KB 75ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/fig45-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "77a6-62153f30d4800"
Age: 1284556
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: m1z6mowyd2eNvttcafC54G8DhvXnb1reMJP1pf7vkqMV7QFGf0TUmA==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:24 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 a0fb529982aa9787ef3a5780a065c43a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 33ms
33ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 45901
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 5da0eb33-101e-0014-2cda-b5820d000000
cf-ray: 8c621544df03d4cc-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/ 99 KB
24 KB 28ms
27ms Fetch
application/x-javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: SDJFQYswktbx6w5cJzzMRQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2B6F9C71
age: 44544
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:15:14 GMT
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:57:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: 16a02b50-101e-0023-7a72-79a340000000
cf-ray: 8c6215452ffbf6c1-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24004
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
4 KB 20ms
19ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 44972
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: e7ba9f8a-a01e-0009-5512-247c50000000
cf-ray: 8c6215457865f6c1-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 24ms
24ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 47516
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 77f313b5-301e-0034-7eb4-210a4b000000
cf-ray: 8c621545886af6c1-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
121 KB 35ms
3ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "859a562c3003b9443ad4e70b3020dad9:1726790028.604703"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 123481
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:48 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 368 B
916 B 25ms
6ms XHR
application/json 52.197.184.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1726838114314

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.197.184.52 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-184-52.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

b01d2140f69feac5a139b650e983d5750c4440787eaa00fbdc1f64f17b7df6ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-04e97baf7.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: cO/AwZKbSdk=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 310
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame 3CFF 0
0 299ms
5ms Document
text/html 13.112.211.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.112.211.211 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-112-211-211.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 20 Sep 2024 13:15:14 GMT
dcs: dcs-prod-tyo3-1-v062-0d937dcc9.edge-tyo3.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 19 Aug 2024 11:56:47 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: lUZ3pl6yT+Y=

GET
H2

200

ibs:dpid=411&dpuuid=Zu11YgAAAJK4QAN8
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=84513195557227243113526244154705204691
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11YgAAAJK4QAN8

42 B
716 B

21ms
9ms

Image
image/gif

52.197.184.52
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11YgAAAJK4QAN8

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Server

52.197.184.52 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-184-52.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-08dcf0c68.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: MBMM1npqTQQ=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11YgAAAJK4QAN8
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Fri, 20 Sep 2024 13:15:14 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
831 B 375ms
31ms XHR
application/json 63.140.50.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=c595b26e46d949cb9af8584ab800f9d4&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.191 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

1fc1746d9732786881654c983bc92df005814f00263557d19305e70695ef6cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: a5f98e89-17a7-4215-a551-af3f95a09def
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Fri, 20 Sep 2024 13:15:14 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 5ms
4ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 4ms
3ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 351ms
55ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 12
cf-polished: origSize=6998
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: text/javascript
last-modified: Fri, 20 Sep 2024 13:15:02 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c621549399ed497-NRT
access-control-allow-origin: *
ce-version: 11.5.282
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 335ms
9ms Script
application/javascript 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66e78018-111cd"
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 16:15:14 GMT
accept-ranges: bytes
content-length: 18822
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Mon, 16 Sep 2024 00:47:20 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 325ms
10ms Script
application/x-javascript 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-225-140.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "7437febf15b08e005ac33eb9fc2707ae:1721634584.416148"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:35:14 GMT
Accept-Ranges: bytes
X-CC: JP
Content-Length: 8614
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:14 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 22 Jul 2024 07:46:05 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 275ms
69ms Script
application/javascript 34.124.133.154
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.124.133.154 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 154.133.124.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_b2Hc8ZtlzZubWomB-B
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 88ms
55ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A87877182AC74818AF3AD4AD0D2E18B7 Ref B: TYO201100117047 Ref C: 2024-09-20T13:15:14Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H2 200 RCac955f2e1e97429197e1e31aaec22e86-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
942 B 7ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCac955f2e1e97429197e1e31aaec22e86-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 685
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 9 KB
2 KB 7ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1846
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 358 B
485 B 7ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 229
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 703 B
684 B 7ms
7ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 427
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 360 KB
118 KB 201ms
95ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

217ba4b460ea7bc3ea3dcf1e24b56335d36a7a70c748d3d778a00378918b0d30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:14 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120795
date: Fri, 20 Sep 2024 13:15:14 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 635 B
642 B 6ms
3ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:14 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 388ms
119ms Fetch
image/gif 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=01112835009587867&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: image/gif;
x-traceid: 55cd21e828c63633472b7e29bf255dd2

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 347ms
114ms Script
application/javascript 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/javascript
x-traceid: 173c47839b66cea01cc0dcd64ddaddf4

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 78ms
7ms Script
text/html 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-32-225-140.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1726821107559
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:16:15 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 22
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:15 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 63b794c791c786e18da33e49c2470af7

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 30ms
6ms Fetch
text/html 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-225-140.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Fri, 20 Sep 2024 13:35:14 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 26
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:14 GMT
Content-Type: text/html

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 54ms
38ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 1061
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:33 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c621549b8150aa8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1782
ce-version: 11.5.282
server: cloudflare

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 27ms
21ms XHR
text/html 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-118-161.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
305 B 27ms
8ms XHR
text/html 2600:140b:1c00:39::1732:761f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:1c00:39::1732:761f Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 718fb5c7b269a16b86bea00135647a151d77118f9e894156f259976d4b71ae44

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a00:1633:128:4::3
expires: Fri, 20 Sep 2024 13:15:14 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1726838114842_388834580_450424_27_847_2_10_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 18
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 201ms
153ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:15 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 167ms
159ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:15 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 172ms
165ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=ipv6&q=%7B%22address%22%3A%222a00%3A1633%3A128%3A4%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:15 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 db7349b994413162218df5c920535415.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 103 KB
35 KB 33ms
32ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1068
cf-ray: 8c62154aec54d497-NRT
cf-polished: origSize=105321
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: text/javascript
last-modified: Fri, 06 Sep 2024 19:46:55 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 371 B
419 B 51ms
33ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

23ef6d583ee52ee9caccce0ad5f20e08c0cf8007f7b16f37776abf51a446d6f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A2E3CD1C13864E20AE11AD013B36F093 Ref B: TYO201100117047 Ref C: 2024-09-20T13:15:14Z
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 732 B
710 B 33ms
11ms XHR
application/json 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 02576d342233ff22484a9efc5c729af4ff68e449f3751636e8bd5e8d3f5aa636

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-encoding: gzip
x-6si-region: ap-northeast-1a
access-control-allow-credentials: true
x-trace-id: 3803878447523277785
access-control-allow-origin: https://www.fortinet.com
content-length: 387
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: nginx

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 54ms
9ms Preflight 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Fri, 20 Sep 2024 13:15:15 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: ap-northeast-1a
x-trace-id: 3005272632259026165

GET
H2 204 0
bat.bing.com/action/ 0
363 B 33ms
24ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=1946b4e5-e4b6-44dd-ba49-172e34205057&sid=5fcc9190775211ef932555c123630503&vid=5fcccc30775211efb398d707fb122a13&vids=1&msclkid=N&pi=918639831&lg=ja-JP&sw=1600&sh=1200&sc=24&tl=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,Cara%20Lin&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&r=&lt=702&pt=1726838113119,,,,,12,13,13,14,152,80,152,226,294,237,671,671,702,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=507372

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FB6CC6162A9C447DA9CDF3A53B7F97FA Ref B: TYO201100117047 Ref C: 2024-09-20T13:15:15Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:14 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
103 KB 89ms
88ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b4cf9a1c5e59761a8992b1692b7490a2c5bc428dfb4f84fc3b342edc51c8c06a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:15 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104906
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
258 B 15ms
15ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 1060
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:35 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c62154b6a6e0aa8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.282
server: cloudflare

GET efde11b8-475b-4efe-b046-496aaa3c80e9
https://www.fortinet.com/ Frame 0
0

GET
H2 200 clock Show response
tracking.crazyegg.com/ 40 B
147 B 120ms
50ms XHR
text/plain 3.37.33.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1&tk=329ee1373036c5ddcda74cf257baa0a6&u=1170786&s=424000&p=%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v=141a2ddaffeb5f7a25035c4a12e60aca83b92e35&f=fortinet.com%2Fblog%2Fthreat-research%2F*&ul=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.37.33.195 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-37-33-195.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 851ca132408587ba49b24285fec021ca24075c2452acf8baddd03f5c5f30f245

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 40
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: text/plain
server: awselb/2.0

GET
H2 200 s26544568397273
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
388 B 24ms
12ms Image
image/gif 63.140.50.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s26544568397273?AQB=1&ndh=1&pf=1&t=20%2F8%2F2024%2022%3A15%3A15%205%20-540&sdid=133483AA0D3752DD-6320FC9418DE56D3&mid=84890700828602783673488493627576054875&aamlh=11&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&c7=Entire%20Site&c8=New&v25=84890700828602783673488493627576054875&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v106=Tokyo&v107=Tokyo&v108=Japan&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.233 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

etag: 3708356614977290240-4618571627923230579
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:15 GMT
p3p: CP="This is not a P3P policy"
date: Fri, 20 Sep 2024 13:15:15 GMT
last-modified: Sat, 21 Sep 2024 13:15:15 GMT
vary: *
x-adobe-ingress: hp
content-type: image/gif;charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block
server: jag

GET
H3 200 ca6be1649b2c6bd5aa79ebaa229fa676.js Show response
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ 20 KB
8 KB 17ms
17ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ca6be1649b2c6bd5aa79ebaa229fa676.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1067
cf-ray: 8c62154c5e60d497-NRT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: text/javascript
last-modified: Wed, 18 Sep 2024 13:30:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 9ca7c9e85a6ce51bd9b80280f971319a.js Show response
script.crazyegg.com/pages/versioned/tracking-scripts/ 95 KB
31 KB 18ms
18ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/tracking-scripts/9ca7c9e85a6ce51bd9b80280f971319a.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1069
cf-ray: 8c62154c8e95d497-NRT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: text/javascript
last-modified: Mon, 16 Sep 2024 20:30:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 251 KB
88 KB 103ms
102ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

6a29e5a99b4adc581751e179a332bd9eb793264c854d1334d5ff7d8c7284696f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 90400
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 170ms
169ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ae7508b6af434ce1865c89b657732af23480ae3326b43fdcdcc43ac679723c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79028
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
83 KB 167ms
166ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 85155
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
86 KB 179ms
179ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

503ca33d17d713049faf87601e9547fe25133948a3ffa6971ec7a9d75fff132b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 88078
x-xss-protection: 0
server: Google Tag Manager

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 71ms
70ms XHR
text/plain 3.37.33.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.37.33.195 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-37-33-195.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: text/plain
server: awselb/2.0

OPTIONS
H2 204 v11
tracking.crazyegg.com/ Frame 0
0 54ms
54ms Preflight 3.37.33.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.37.33.195 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-37-33-195.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Fri, 20 Sep 2024 13:15:15 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 91ms
38ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je49j0v9191763579za200&_p=1726838114471&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=775319313.1726838115&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838115&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2344
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 51 KB
18 KB 50ms
4ms Script
application/javascript 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd78-cca5"
cdn-fileserver: 869
date: Fri, 20 Sep 2024 13:15:15 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:24 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 790978d1332e67939beabec068e62d32
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1184
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 24ms
3ms Stylesheet
text/css 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: 71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd79-2644"
cdn-fileserver: 681
date: Fri, 20 Sep 2024 13:15:15 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:25 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 2fcfb7ea340ca2bf925f238ba18048ae
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1185
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
593 B 235ms
211ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Fri, 20 Sep 2024 13:15:20 GMT
x-cache: Error from cloudfront
x-amz-cf-id: dhsgM3gwfn0JHIw662FyEaPYLnyAyUrnUeWhGoisVAFxbZrWaJoVRg==
date: Fri, 20 Sep 2024 13:15:15 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 abe247adaab2cff314bfe6787604d9ea.cloudfront.net (CloudFront)
cf-ray: 8c62154e3ef45eb0-NRT
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: NRT57-P3
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 94ms
72ms Script
text/javascript 2606:4700::6812:1247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1247 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 76843
via: 1.1 google
cf-ray: 8c62154e39683511-NRT
expires: Fri, 20 Sep 2024 13:35:15 GMT
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 391ms
131ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Fri, 20 Sep 2024 13:15:15 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 249ms
223ms Script
text/javascript 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20240920T131515Z-r1677749c86jctxpzrre0hbbu800000001w00000000167aq

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
711 B 538ms
178ms Script
text/javascript 74.121.140.211
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.121.140.211 Reston, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master iad iad-pixel-x1 config_version:"2232" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Fri, 20 Sep 2024 13:15:16 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master iad iad-pixel-x1 config_version:"2232"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
105 KB 93ms
90ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f1d0599a803eb0bc984213e78d9f0ad1cefb2969b1fff4862df9ee0927d20df1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:15 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106998
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H/1.1 200
OK footer-links.json Show response
www.fortinet.com/content/dam/fortinet-blog/ 310 KB
36 KB 81ms
79ms XHR
application/json 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/footer-links.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "4d8dc-61d89b0f78340-gzip"
Age: 5511007
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ocfvkbpZKaR1Nz29olzC0Pm4ZX7CKFXR7cNQJFMCs2-0Aqh3-3Px0Q==
Date: Fri, 20 Sep 2024 01:13:59 GMT
Content-Type: application/json
Vary: Accept-Encoding
Last-Modified: Thu, 18 Jul 2024 18:24:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35378
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 6 KB
2 KB 110ms
62ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1726838115578&cv=11&fst=1726838115578&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

d0c889c0237dcaf411c6e4bb40de96fb15f2cd0dac627cc124af397b9cedb27d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2401
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame 5BDD 0
0 165ms
109ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1726838115578&cv=11&fst=1726838115578&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=997501737.1726838115;ps=1;pcor=1713281419;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=1...
td.doubleclick.net/td/fls/rul/ Frame 2A8C 0
0 49ms
45ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=997501737.1726838115;ps=1;pcor=1713281419;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=997501737.1726838115;ps=1;pcor=1713281419;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l...
ad.doubleclick.net/ 42 B
65 B 115ms
41ms Image
image/gif 172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=997501737.1726838115;ps=1;pcor=1713281419;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=997501737.1726838115;ps=1;pcor=1713281419;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123...
ad.doubleclick.net/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 6 KB
2 KB 53ms
53ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1726838115720&cv=11&fst=1726838115720&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

9294bc4573446dc911bda21aa48ea194d1ebcd30dab277169ed88a6d887b30d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2409
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 7234 0
0 115ms
106ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1726838115720&cv=11&fst=1726838115720&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 6 KB
2 KB 54ms
54ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1726838115803&cv=11&fst=1726838115803&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

386e79737d293b51421c70a21f1b97bbee908dd648259abdf49cf411569eae31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2408
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 609297413
td.doubleclick.net/td/rul/ Frame F8BF 0
0 106ms
104ms Document
text/html 172.217.161.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1726838115803&cv=11&fst=1726838115803&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.161.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s23-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 202ms
187ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838115836&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 20 Sep 2024 13:15:15 GMT
expires: Fri, 20 Sep 2024 13:15:15 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AD-8ljssZ9MjbNtLb-eOJ6duNRgSSJ8QHVw_V0GeVjbZYRxlxzMgu5XZ9Lj4mW1US6UPtY5-Izo

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
440 B 198ms
195ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838115836&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 14:15:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Fri, 20 Sep 2024 13:15:16 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AD-8ljtY9DEUgmIkE0KHxPVdZyN47sZeN0Ppo8upgvDR03MGcc87Cp4C7z2ozKCB-lc9cuRAoIc
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

GET
H3 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
64 B 86ms
44ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1726838115578&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfQVW2_lHsB-P-cuyJSA5VkpA08nzyzQ&random=1590130498&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/662878185/ 42 B
64 B 122ms
54ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/662878185/?random=1726838115578&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfQVW2_lHsB-P-cuyJSA5VkpA08nzyzQ&random=1590130498&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 194ms
193ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%22%2C%22timeSpent%22%3A%221025%22%2C%22totalTimeSpent%22%3A%221025%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:16 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:16 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 75ms
45ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1726838115720&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnf-IRIf4yRtPSbY6Ljq0hO9RDNj-74-pL_k5Rcu57_gE9xSK2L&random=1687457431&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/729495989/ 42 B
64 B 110ms
53ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/729495989/?random=1726838115720&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnf-IRIf4yRtPSbY6Ljq0hO9RDNj-74-pL_k5Rcu57_gE9xSK2L&random=1687457431&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 401 / Show response
pixels.argusplatform.com/wh/track/ 205 B
468 B 1018ms
962ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838116969626176&event_type=page_request&timestamp=1726838116&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:16 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131515Z-r1677749c86ztt26e9vwzydaag0000000bxg00000000fx45

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 56ms
45ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1726838115803&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfDIbwE3luz9QRF6L4uI_la-Xtqw6rJuFGg7w3P-UO7kUnak4a&random=2934009094&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/609297413/ 42 B
64 B 90ms
51ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/609297413/?random=1726838115803&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=997501737.1726838115&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfDIbwE3luz9QRF6L4uI_la-Xtqw6rJuFGg7w3P-UO7kUnak4a&random=2934009094&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:15 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
15 KB 19ms
3ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 13679
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-nrt-rjtf7700037-NRT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15023
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 135ms
134ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Fri, 20 Sep 2024 13:11:41 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 404ms
132ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Fri, 20 Sep 2024 13:11:41 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 69ms
67ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je49j0v893708426za200zb9123037237&_p=1726838114471&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=775319313.1726838115&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838115&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2877
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:16 GMT
content-type: text/plain
server: Golfe2

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 128ms
127ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838116237&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:16 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
BLOB 200
OK b11ab7cc-1279-4224-a61b-509c739d37a6
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/b11ab7cc-1279-4224-a61b-509c739d37a6
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 525ms
138ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838116237&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:16 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 182 KB
66 KB 94ms
94ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d98d45daf1fc77cbdb8d3ec5d2b92d287cfa2dc94a385367b7655fc4daa1c7ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 67125
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 188ms
186ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A15%20GMT%22%2C%22timeSpent%22%3A%221008%22%2C%22totalTimeSpent%22%3A%222033%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:17 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838116237
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838116237&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AAF_7k7N2usAABTiiMx9tQ

0
0

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
1015 B 10ms
2ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 758
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 19ms
11ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 9ms
1ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 661 B
648 B 18ms
11ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 368 B
492 B 18ms
11ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 235
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 754 B
704 B 17ms
11ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
971 B 16ms
10ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 714
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1021 B
857 B 36ms
30ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 601
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
758 B 37ms
32ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 502
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 388 B
498 B 38ms
33ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 664 B
657 B 37ms
33ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 401
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7675832323134b109ff7c59296e2d2ca-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
797 B 37ms
33ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7675832323134b109ff7c59296e2d2ca-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 540
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
981 B 33ms
29ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 724
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 966 B
809 B 32ms
28ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:17 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 552
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
761 B 89ms
74ms Script
application/javascript 34.124.133.154
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.124.133.154 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 154.133.124.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: dc90ea2d825c5f532a34e2a498ed6bfd5f3cd0cf7b3537fee7259831505790a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H2 401 / Show response
webtracker.argusplatform.com/wh/track/ 205 B
468 B 1239ms
1148ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838116969626176&event_type=page_request&timestamp=1726838117&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131517Z-r1677749c86ss7mtdm94k98nys0000000bxg00000001cstg

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 92ms
90ms XHR
text/plain 3.37.33.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.37.33.195 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-37-33-195.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: text/plain
server: awselb/2.0

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 632ms
176ms Script
application/javascript 54.69.255.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=13257345715127112term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 54.69.255.140 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-69-255-140.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: ee9baf9e36e9e7b53b1cbc5bb42d4f88567fb4b30d88558fc92423d50def6273

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 2
connection: close
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 28ms
6ms Script
application/javascript 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Fri, 20 Sep 2024 13:15:17 GMT
x-tw-cdn: FT
last-modified: Tue, 26 Mar 2024 20:58:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kcgs7200117-IAD, cache-hnd18743-HND
x-amz-server-side-encryption: AES256

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

178ms
114ms

Image
image/gif

103.43.90.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

103.43.90.21 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

597.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 31.204.145.170; 31.204.145.170; 597.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 340cfd2b-46fb-45aa-94cd-2d1cacdf78ff
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:17 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 31.204.145.170; 31.204.145.170; 597.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 3cb5717f-76f2-438a-afac-0e001f1ef531
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:17 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

105ms
101ms

Image
image/gif

103.43.90.179
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

103.43.90.179 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 31.204.145.170; 31.204.145.170; 592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a035c5a1-1a3e-463f-8e85-6fd70488e289
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:17 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 31.204.145.170; 31.204.145.170; 592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d25327dc-c397-460d-a2b9-98e4067d7ebf
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:17 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
443 B 28ms
6ms Script
application/octet-stream 2600:9000:2751:ac00:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2751:ac00:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 57793
via: 1.1 36cf18acfba4fa4f3949b71621f2b1e8.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: lB8U4wuRYfRoZDT6VZWTxt5V2dCikTfXMrGqM9AhcMtCP7pE5NxuvA==
date: Thu, 19 Sep 2024 21:12:21 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 84ms
78ms Other
image/vnd.microsoft.icon 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 6105652
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5KXOEpedu-yB6LF72lol5hJxbWpAtP6PlqH06swjtnCLmOMnucKx1w==
Date: Fri, 20 Sep 2024 13:15:06 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H3

200

pixel
capi.connatix.com/us/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=BA538520521648E9919712AEE5D583A8
https://capi.connatix.com/us/pixel?puid=4fb91121a4&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}
https://capi.connatix.com/us/pixel?puid=4fb91121a4&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true

82 B
82 B

140ms
132ms

Image
image/gif

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=4fb91121a4&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

surrogate-control: no-cache, no-store, must-revalidate, max-age=0
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8c62156059501ed4-NRT
content-length: 95
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
location: https://capi.connatix.com/us/pixel?puid=4fb91121a4&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true
cf-cache-status: DYNAMIC
cf-ray: 8c62155f38201ed4-NRT
content-length: 0
date: Fri, 20 Sep 2024 13:15:18 GMT
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

GET
H2

204

BA538520521648E9919712AEE5D583A8
sync.1rx.io/usersync/simplifi/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/BA538520521648E9919712AEE5D583A8

0
99 B

455ms
35ms

Image
text/plain

74.118.186.107
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1rx.io/usersync/simplifi/BA538520521648E9919712AEE5D583A8
Protocol: H2
Server: 74.118.186.107 Serangoon New Town, Singapore, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
date: Fri, 20 Sep 2024 13:15:18 GMT
pragma: no-cache

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.1rx.io/usersync/simplifi/BA538520521648E9919712AEE5D583A8
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=BA538520521648E9919712AEE5D583A8&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=BA538520521648E9919712AEE5D583A8&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
474 B

87ms
71ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=BA538520521648E9919712AEE5D583A8&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=BA538520521648E9919712AEE5D583A8&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:18 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=BA538520521648E9919712AEE5D583A8

43 B
175 B

676ms
175ms

Image
image/gif

2600:1f18:612b:4216:2684:b32f:7d35:8ca4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=BA538520521648E9919712AEE5D583A8
Protocol: H2
Server: 2600:1f18:612b:4216:2684:b32f:7d35:8ca4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=BA538520521648E9919712AEE5D583A8
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=BA538520521648E9919712AEE5D583A8
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=BA538520521648E9919712AEE5D583A8

95 B
428 B

124ms
59ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=BA538520521648E9919712AEE5D583A8

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=BA538520521648E9919712AEE5D583A8
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 20 Sep 2024 13:15:18 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=BA538520521648E9919712AEE5D583A8
https://d.agkn.com/pixel/10751/?che=1726838118098&ip=31.204.145.170&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D232883305011003801845
https://um.simpli.fi/aa_px?sk=232883305011003801845
https://um.simpli.fi/empty.gif

43 B
361 B

95ms
74ms

Image
image/gif

34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BA538520521648E9919712AEE5D583A8
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BA538520521648E9919712AEE5D583A8&ckls=true&ci=B4lqTSwp81&nc=false&trid=-2053411095

43 B
1 KB

483ms
461ms

Image
image/gif

3.164.110.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BA538520521648E9919712AEE5D583A8&ckls=true&ci=B4lqTSwp81&nc=false&trid=-2053411095
Protocol: H2
Server: 3.164.110.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-110-92.nrt12.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 edb1cbbe9bc836edc0729df1a5331a3a.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: _uKFWW0AR3F7vM805UOYf8KyhRvMyA24f7nCDB_E4GQotPpfx0ACMw==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BA538520521648E9919712AEE5D583A8&ckls=true&ci=B4lqTSwp81&nc=false&trid=-2053411095
pragma: no-cache
via: 1.1 edb1cbbe9bc836edc0729df1a5331a3a.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: 8RmMeMJhUcAZBeuPph_2u2R4vKtRc0KlQP_--Cc1OfiphB2nbqe8CA==

GET
H2 200 pubmatic
um.simpli.fi/ 43 B
409 B 107ms
80ms Image
image/gif 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 freewheel
um.simpli.fi/ 43 B
409 B 109ms
82ms Image
image/gif 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/freewheel

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

getuid
sync.smartadserver.com/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=BA538520521648E9919712AEE5D583A8;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=BA538520521648E9919712AEE5D583A8;mimetype=img;sr
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid]
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

0
316 B

103ms
102ms

Image
text/plain

23.106.127.57
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
Protocol: HTTP/1.1
Server: 23.106.127.57 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 20 Sep 2024 13:15:18 GMT
pragma: no-cache

Redirect headers

cache-control: no-cache,no-store
location: https://sync.smartadserver.com:443/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 20 Sep 2024 13:15:18 GMT
pragma: no-cache

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=BA538520521648E9919712AEE5D583A8&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=BA538520521648E9919712AEE5D583A8&j=0&xl8blockcheck=1

0
2 KB

737ms
735ms

Image
text/plain

34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=BA538520521648E9919712AEE5D583A8&j=0&xl8blockcheck=1
Protocol: H2
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:19 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=BA538520521648E9919712AEE5D583A8&j=0&xl8blockcheck=1
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET
H2 200 yahoo
um.simpli.fi/ 43 B
409 B 106ms
80ms Image
image/gif 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/yahoo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=BA538520521648E9919712AEE5D583A8

0
421 B

966ms
368ms

Image
text/plain

52.21.56.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=BA538520521648E9919712AEE5D583A8
Protocol: HTTP/1.1
Server: 52.21.56.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-21-56-232.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Fri, 20 Sep 2024 13:15:17 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=BA538520521648E9919712AEE5D583A8
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=BA538520521648E9919712AEE5D583A8

62 B
446 B

437ms
145ms

Image
image/gif

23.36.17.70
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=BA538520521648E9919712AEE5D583A8
Protocol: H2
Server: 23.36.17.70 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-17-70.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://stags.bluekai.com/site/29931?id=BA538520521648E9919712AEE5D583A8
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=BA538520521648E9919712AEE5D583A8
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=BA538520521648E9919712AEE5D583A8
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=BA538520521648E9919712AEE5D583A8

49 B
265 B

115ms
93ms

Image
image/gif

13.228.141.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=BA538520521648E9919712AEE5D583A8
Protocol: H2
Server: 13.228.141.56 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-228-141-56.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
x-server: 10.42.20.186
server: Jetty(9.4.38.v20210224)

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=BA538520521648E9919712AEE5D583A8
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:18 GMT
x-server: 10.42.19.32
server: Jetty(9.4.38.v20210224)

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=BA538520521648E9919712AEE5D583A8
https://ce.lijit.com/merge?pid=2&3pid=BA538520521648E9919712AEE5D583A8&dnr=1

43 B
511 B

427ms
417ms

Image
image/gif

54.71.108.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=BA538520521648E9919712AEE5D583A8&dnr=1
Protocol: H2
Server: 54.71.108.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-71-108-129.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=BA538520521648E9919712AEE5D583A8&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:18 GMT
vary: Accept-Encoding

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=BA538520521648E9919712AEE5D583A8
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogQkE1Mzg1MjA1MjE2NDhFOTkxOTcxMkFFRTVENTgzQTgQABoNCObqtbcGEgUI6AcQAEIASgA
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=06367349
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=06367349&dcc=t

43 B
855 B

208ms
208ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=06367349&dcc=t

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: BEMVMWVZSK90Z9Q6878T
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 20 Sep 2024 13:15:20 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=06367349&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 54PSE24TV0B0K5BBNNYK
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 20 Sep 2024 13:15:19 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

/
www.google.co.jp/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838117250&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHB...
https://www.google.com/pagead/1p-conversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDs...
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLH...

42 B
64 B

108ms
71ms

Image
image/gif

142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMI1uLUpM3RiAMVNKHpBR2UTwJTMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnf_E8Hb7roaUJwA_-pPoRKquCQSJ2ZznZ7-GZHUk0qqxGRrRKY&random=3732702806&ipr=y

Protocol

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=813805076&cv=7&fst=1726838117250&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMI1uLUpM3RiAMVNKHpBR2UTwJTMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnf_E8Hb7roaUJwA_-pPoRKquCQSJ2ZznZ7-GZHUk0qqxGRrRKY&random=3732702806&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 107ms
81ms Image
text/plain 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:17 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=BA538520521648E9919712AEE5D583A8

43 B
1 KB

149ms
76ms

Image
image/gif

103.43.90.179
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=BA538520521648E9919712AEE5D583A8

Protocol

Server

103.43.90.179 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 31.204.145.170; 31.204.145.170; 592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: ab8573bb-073f-4218-b217-cea84eb9f769
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:18 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=BA538520521648E9919712AEE5D583A8
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BA538520521648E9919712AEE5D583A8&expires=365

42 B
1 KB

468ms
76ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BA538520521648E9919712AEE5D583A8&expires=365
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: cc2b9026541f49c9c095b4cedfcedb9a
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BA538520521648E9919712AEE5D583A8&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:17 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=BA538520521648E9919712AEE5D583A8
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BA538520521648E9919712AEE5D583A8

43 B
171 B

60ms
39ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BA538520521648E9919712AEE5D583A8
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BA538520521648E9919712AEE5D583A8
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 0
date: Fri, 20 Sep 2024 13:15:18 GMT
server: OXGW/0.0.0

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEEyD1UlrsuVKyoRj6oByeCQ&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=BA538520521648E9919712AEE5D583A8
https://um.simpli.fi/g_match?id=

0
320 B

88ms
69ms

Image
text/plain

34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:18 GMT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:18 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 229
date: Fri, 20 Sep 2024 13:15:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5786336105875.167
10104846.fls.doubleclick.net/activityi;dc_pre=COeX1aTN0YgDFcFUDwIdchoCXg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame DE0C
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;d...
https://10104846.fls.doubleclick.net/activityi;dc_pre=COeX1aTN0YgDFcFUDwIdchoCXg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoser...

0
0

69ms
64ms

Document
text/html

172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=COeX1aTN0YgDFcFUDwIdchoCXg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5786336105875.167?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2245
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:17 GMT
expires: Fri, 20 Sep 2024 13:15:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=COeX1aTN0YgDFcFUDwIdchoCXg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5786336105875.167?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 254ms
40ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=14, rtx=0, c=23, mss=1232, tbw=4614, tp=12, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: xIrT6nsxyAqM5iSE1/JPOriKdwgvbYZUCpYTP27wveGtC5Z/9FLP5Y/O+1txwqu/kvogJfPM2UZiGTfrGTRZXQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 58953
x-xss-protection: 0

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 237ms
64ms Script
application/javascript 172.67.163.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "8451e15415563cef4e816d6dd250d58a"
age: 4672
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IPmB5kDIfyvLCEgCNxEZ5YSxWoCqJRzb3cqri2MfMRZoJtJ%2Fv04uGfkey84aLnR4bYdOG%2B0Veotba%2F4JP4%2BYfWKGwV9vMfHJ6bitWhOQw4tFycYWmdhsRFmYYo8ODPYZ0e6G6P1jYaZKrf4%3D"}],"group":"cf-nel","max_age":604800}
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: sTkDkSK9HUh028oNwUCpa46zvLg3uWScP1JIOimSH7ZnBP6RVzYB99nneweYIrQZV53roIQam1DvGvg4U8yv5O8p2Pg4slpY
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: TJZRBJ31M53E82Z7
cf-ray: 8c62155ed9dcd543-NRT
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
628 B 336ms
139ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=bcb733f7-5a8d-4bc9-b7e7-9076606d0281&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1c93e1ab-5b88-4e33-8f13-9dd88f11ab49&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: dab2695c50db93bc
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 0a9072f94ba7d1aa28b11e86131c84dd91e4142ae05fc2a68474c6ac27839c33
cf-cache-status: DYNAMIC
cf-ray: 8c62155f4f6e20b3-NRT
x-response-time: 97
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
216 B 218ms
107ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=bcb733f7-5a8d-4bc9-b7e7-9076606d0281&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1c93e1ab-5b88-4e33-8f13-9dd88f11ab49&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: aaaa6bf6ecb36c53
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 38e0e8932febe2fea79fcc6725ecb293d5f0dbd8d3e93d0956ce83280dd85707
x-response-time: 99
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 adsct
t.co/i/ 43 B
462 B 140ms
123ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=05e6d4c4-d74b-48c7-be38-6f01b069a0cd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1c93e1ab-5b88-4e33-8f13-9dd88f11ab49&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 7c25eaa6a2b946e1
cache-control: no-cache, no-store, max-age=0
x-connection-hash: dc363d995fec5cc490b16039e500ee9d146261e99553f432a3c85010f46e975b
cf-cache-status: DYNAMIC
cf-ray: 8c62155f6f8c20b3-NRT
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 189ms
101ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=05e6d4c4-d74b-48c7-be38-6f01b069a0cd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1c93e1ab-5b88-4e33-8f13-9dd88f11ab49&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 8f7e132c1be5e3b5
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 38e0e8932febe2fea79fcc6725ecb293d5f0dbd8d3e93d0956ce83280dd85707
x-response-time: 96
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 adsct
t.co/i/ 43 B
468 B 141ms
124ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=a8901fe0-ad81-4287-9098-1faf39a5a259&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1c93e1ab-5b88-4e33-8f13-9dd88f11ab49&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 3064bf7b3effdf7d
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 2f22e112faa80cb2d7a618b0991b42746800f43d7b7de6d896313101bda99e75
cf-cache-status: DYNAMIC
cf-ray: 8c62155f6f9020b3-NRT
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
238 B 158ms
104ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=a8901fe0-ad81-4287-9098-1faf39a5a259&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1c93e1ab-5b88-4e33-8f13-9dd88f11ab49&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: d04881e6af081abf
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 38e0e8932febe2fea79fcc6725ecb293d5f0dbd8d3e93d0956ce83280dd85707
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:17 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 175ms
169ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A16%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223033%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:18 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK is Show response
100.20.58.101/ 32 B
437 B 872ms
426ms Fetch
text/plain 100.20.58.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://100.20.58.101/is
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=13257345715127112term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 100.20.58.101 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-58-101.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 139123285e74312236c54dc1760f901619058e9fa98a2ecc75ee386cc7f578ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 2
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
13 KB 601ms
16ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?208
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
content-encoding: br
age: 266
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Fri, 20 Sep 2024 13:10:53 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AD-8ljuMOIQtzF7pR7QW9168kCuY6bPc2J5rHzk3R6Pmc0ub7VpnFnU2YTaDWY_l4lA6kdezWp2OiGPF7w
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: NRT
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 12522
server: UploadServer

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 595ms
21ms Script
application/javascript 2600:140b:1a00:4::17c1:b893
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:140b:1a00:4::17c1:b893 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=61971
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 20 Sep 2024 13:15:19 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 1039ms
283ms Image
image/gif 13.48.36.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=5264&prev=ceaa6c64-b6c0-241e-ee84-c98b4aa4a9b3&luid=78f2079e-1c19-7440-9962-ce33ac6deaa6&rnd=17285
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.48.36.94 Stockholm, Sweden, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-48-36-94.eu-north-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Fri, 20 Sep 2024 13:15:19 UTC
cache-control: max-age=0
content-length: 34
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: image/gif

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 5ms
5ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.167&r=stable&domain=www.fortinet.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=74, mss=1232, tbw=67254, tp=65, tpl=0, uplat=2, ullat=-1
pragma: public
x-fb-debug: otLb2u21ERHfiRWAJFMsSKRdLe5Oy+3l0ZSRU4IMTexSO+fw9kqCbg0vUvSIwDHuQwlNZ1nXo4o77JYk9UGLew==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 13328
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 212ms
201ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A17%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%224038%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:19 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 158ms
4ms Image
text/plain 2a03:2880:f10f:187:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838119025&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838119006.70715150275902385&ler=empty&cdl=API_unavailable&it=1726838118567&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:187:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=3, rtx=0, c=10, mss=1297, tbw=2827, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 350ms
198ms Image
image/png 2a03:2880:f10f:187:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838119025&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838119006.70715150275902385&ler=empty&cdl=API_unavailable&it=1726838118567&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:187:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7416713248623260013"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x1df81ccff3911cb6","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"2":["24:1473595392721544","7830:1473595392721544","10853:1473595392721544","41:1473595392721544","8046:1473595392721544"]},"debug_reporting":true,"debug_key":"4571464485052856095"}
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: dw9mUHodyqQKijLtLNm2yuN/H+1A+v/j7Qa2fwmizJ07Lg7QQhkPZrfXm89Nbh1cfUVZmmO5A3A3yIc84bJijw==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7416713248623260013", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=2, rtx=0, c=10, mss=1297, tbw=3144, tp=-1, tpl=-1, uplat=165, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H/1.1 200
OK st Show response
px.mountain.com/ 2 KB
1 KB 1132ms
151ms Script
application/javascript 35.85.106.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=775319313.1726838115&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22775319313.1726838115%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838115.1%22%2C%22mntnis%22%3A%22%2BQfgZZ8nADls51aed3fMa%2FrxQw1A02Kc%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A10%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838115.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838115%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838115%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=13257345715127112term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=13257345715127112term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.85.106.161 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-106-161.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 3403d15e3aea027418cb9b1c77d34e60103de3156859b663956be5df10e331fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 17
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:20 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H2 200 utsync.ashx Show response
ml314.com/ 575 B
1 KB 80ms
35ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pv=1726838119116_sma749u75&bl=ja-jp&cb=3061614&return=&ht=&d=&dc=&si=1726838119116_sma749u75&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?208
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 1b622ff54d757665f5749cada9373b800806f3a18383a3cac151e8f02696d04f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
761 B 255ms
195ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290&time=1726838119182&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-fs-uuid: 0006228cd4b005049b313f181ed6eaf0
x-msedge-ref: Ref A: 0F28C04AEB0D44DCB2348AEF78D8A7B7 Ref B: TYAEDGE1122 Ref C: 2024-09-20T13:15:19Z
x-li-fabric: prod-ltx1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYijNSwBQSbMT8YHtbq8A==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838119182&li_adsId=81af5af2-7bf2-4248-89d5-2a8b908c0fcf&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-resea...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838119182&li_adsId=81af5af2-7bf2-4248-89d5-2a8b908c0fcf&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-rese...

0
486 B

644ms
136ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838119182&li_adsId=81af5af2-7bf2-4248-89d5-2a8b908c0fcf&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQItcZON_FKCpQAAAZIPkpuQboQqNtUaSymaU89x0FanYL1u0DFj3EsbW2X510gv5XNvQQ
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 1ADE2D9094A540AD80B4386D3420579A Ref B: TYBEDGE0611 Ref C: 2024-09-20T13:15:19Z
x-li-fabric: prod-lor1
x-li-uuid: AAYijNS5NWrFTIwel/W/1Q==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838119182&li_adsId=81af5af2-7bf2-4248-89d5-2a8b908c0fcf&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQItcZON_FKCpQAAAZIPkpuQboQqNtUaSymaU89x0FanYL1u0DFj3EsbW2X510gv5XNvQQ
x-msedge-ref: Ref A: 7C0693345DF64FCE81B5181F9A49F057 Ref B: TYBEDGE0508 Ref C: 2024-09-20T13:15:19Z
x-li-fabric: prod-lor1
x-li-uuid: AAYijNSvkRLUaFbpp1HfSQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:18 GMT

GET
H2 200 ibs:dpid=22052&dpuuid=3647144418421506066&redir=
dpm.demdex.net/ 42 B
715 B 33ms
12ms Image
image/gif 52.197.184.52
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647144418421506066&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.197.184.52 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-184-52.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-2-v062-0e21ed76e.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: Em9i4n6bSps=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: image/gif

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=

43 B
61 B

70ms
69ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 21 Sep 2024 13:15:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=
content-length: 241
date: Fri, 20 Sep 2024 13:15:19 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144418421506066
https://ml314.com/csync.ashx?fp=7eb9da8c76d7741ca1f47ea6c0529648&eid=50146&person_id=3647144418421506066

43 B
56 B

65ms
65ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=7eb9da8c76d7741ca1f47ea6c0529648&eid=50146&person_id=3647144418421506066
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Sat, 21 Sep 2024 13:15:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache
location: https://ml314.com/csync.ashx?fp=7eb9da8c76d7741ca1f47ea6c0529648&eid=50146&person_id=3647144418421506066
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:19 GMT
x-server: 10.42.22.10
server: Jetty(9.4.38.v20210224)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2RFrRYqDtPICaqzHzAH1L2KW-gIDwPXMaQdnt9k9RMYQ&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

13ms
13ms

Image
image/gif

18.182.162.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 18.182.162.20 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 20 Sep 2024 13:15:19 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 21 Sep 2024 13:15:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
content-length: 43
date: Fri, 20 Sep 2024 13:15:19 GMT
content-type: image/gif
x-cloud-trace-context: c7550dc7392e2832b679f3269b226f30
server: Google Frontend

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 190ms
189ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A18%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%225043%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:20 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:20 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
196 B 141ms
117ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 9947BC95529E4877B0B1DB7EC7737E9F Ref B: TYBEDGE0508 Ref C: 2024-09-20T13:15:20Z
x-li-fabric: prod-lor1
access-control-allow-credentials: true
x-li-uuid: AAYijNS70Vko/Do4/Hf6Og==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:19 GMT
vary: Origin

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
733 B 911ms
169ms Script
application/javascript 35.81.162.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=775319313.1726838115&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22775319313.1726838115%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838115.1%22%2C%22mntnis%22%3A%22%2BQfgZZ8nADls51aed3fMa%2FrxQw1A02Kc%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A10%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838115.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838115%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838115%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=13257345715127112term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 41859b2a0fc322848caf0994308be6207e431b91ccc2daa0208db837bc7890bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 2
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:21 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 176ms
172ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A19%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%226046%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:21 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:21 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 5 KB
2 KB 423ms
154ms Script
application/javascript 35.85.106.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=775319313.1726838115&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22775319313.1726838115%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838115.1%22%2C%22mntnis%22%3A%22%2BQfgZZ8nADls51aed3fMa%2FrxQw1A02Kc%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A10%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838115.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838115%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838115%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1726838120169146&shguid=25ed0643-9588-3e1b-8e64-b3974582072b&shgts=1726838121057
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=775319313.1726838115&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22775319313.1726838115%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838115.1%22%2C%22mntnis%22%3A%22%2BQfgZZ8nADls51aed3fMa%2FrxQw1A02Kc%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A10%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838115.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838115%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838115%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=13257345715127112term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.85.106.161 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-106-161.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: a36d267af0824f0df68c73dfef7da4492ec4d90da8ccf9077303bf6279a44426

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 19
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:21 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=62de3d2e-7752-11ef-ae8d-1df8c297f37c&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=a5773930-db33-43ae-8f4c-c85a5da03847&shguid=62de3d2e-7752-11ef-ae8d-1df8c297f37c

0
319 B

1219ms
209ms

Image
text/plain

52.10.121.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=a5773930-db33-43ae-8f4c-c85a5da03847&shguid=62de3d2e-7752-11ef-ae8d-1df8c297f37c
Protocol: HTTP/1.1
Server: 52.10.121.135 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-10-121-135.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 49
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:22 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=a5773930-db33-43ae-8f4c-c85a5da03847&shguid=62de3d2e-7752-11ef-ae8d-1df8c297f37c
content-length: 277
date: Fri, 20 Sep 2024 13:15:21 GMT
server: Kestrel

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YTU3NzM5MzAtZGIzMy00M2FlLThmNGMtYzg1YTVkYTAzODQ3&gdpr=0&gdpr_consent=&ttd_tdid=a5773930-db33-43ae-8f4c-c85a5...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=a5773930-db33-43ae-8f4c-c85a5da03847&google_gid=CAESEDlOYno0e1--BsMseH9AsQ8&google_cver=1
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://tags.bluekai.com/site/5386?id=a5773930-db33-43ae-8f4c-c85a5da03847&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=a5773930-db33-43ae-8f4c-c85a5da03847&r=https%3A%2F%2Fmatch.adsrvr.org%2...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic

70 B
501 B

90ms
50ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-length: 70
date: Fri, 20 Sep 2024 13:15:22 GMT
content-type: image/gif
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 19 Sep 2024 21:19:56 GMT
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 660ms
244ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A20%20GMT%22%2C%22timeSpent%22%3A%221012%22%2C%22totalTimeSpent%22%3A%227058%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:22 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:22 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 232ms
162ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A21%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%228058%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:23 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:23 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET img.gif
b.6sc.co/v1/beacon/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 172ms
171ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A23%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%2210059%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:25 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:25 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.fortinet.com
URL: blob:https://www.fortinet.com/efde11b8-475b-4efe-b046-496aaa3c80e9

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=997501737.1726838115;ps=1;pcor=1713281419;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AAF_7k7N2usAABTiiMx9tQ

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=66aa6d32-056f-460b-8079-7e9efe19892b&session=6902eab3-bdd0-48c3-8e69-e8958bc5ecef&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A22%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229059%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=9e98d3d8-0e72-415d-8ef3-d7d6fad8d6ba&ipv6=2a00%3A1633%3A128%3A4%3A%3A3&v=1.1.27

Verdicts & Comments Add Verdict or Comment

162 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

115 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 08:26:14	Name: cookiesession1 Value: 678A3E23EBADD01CC590714F5C9A6DE7
.fortinet.com/	1970-01-21 08:26:14	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Fri+Sep+20+2024+22%3A15%3A14+GMT%2B0900+(%E6%97%A5%E6%9C%AC%E6%A8%99%E6%BA%96%E6%99%82)&version=6.10.0&hosts=&consentId=80c24a7e-eb40-4744-bec9-324a8934e746&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 03:59:50	Name: demdex Value: 84513195557227243113526244154705204691
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-21 09:16:38	Name: mbox Value: session#c595b26e46d949cb9af8584ab800f9d4#1726839975\|PC#c595b26e46d949cb9af8584ab800f9d4.32_0#1790082915
.fortinet.com/	1970-01-20 23:40:39	Name: mboxEdgeCluster Value: 32
www.fortinet.com/	1970-01-21 09:16:38	Name: _gd_visitor Value: 66aa6d32-056f-460b-8079-7e9efe19892b
www.fortinet.com/	1970-01-20 23:40:52	Name: _gd_session Value: 6902eab3-bdd0-48c3-8e69-e8958bc5ecef
.dpm.demdex.net/	1970-01-21 03:59:50	Name: dpm Value: 84513195557227243113526244154705204691
.fortinet.com/	1970-01-21 09:16:38	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C19987%7CMCMID%7C84890700828602783673488493627576054875%7CMCAAMLH-1727442914%7C11%7CMCAAMB-1727442914%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1726845314s%7CNONE%7CMCSYNCSOP%7C411-19994%7CvVersion%7C5.5.0
.fortinet.com/	1970-01-20 23:42:04	Name: _uetsid Value: 5fcc9190775211ef932555c123630503
.fortinet.com/	1970-01-21 09:02:14	Name: _uetvid Value: 5fcccc30775211efb398d707fb122a13
.bing.com/	1970-01-21 09:02:14	Name: MUID Value: 19DBF20BC3C86CC733E8E70BC2AC6D40
.bat.bing.com/	1970-01-20 23:50:42	Name: MR Value: 0
.simpli.fi/	1970-01-21 08:27:40	Name: suid Value: BA538520521648E9919712AEE5D583A8
.fortinet.com/	1969-12-31 23:59:59	Name: _ce.irv Value: new
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_event Value: 1
.fortinet.com/	1970-01-20 23:40:39	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
.fortinet.com/	1970-01-21 01:50:14	Name: s_getNewRepeat Value: 1726838115210-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_data Value: 23%2C31.204.145.170%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CJP
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 08:26:14	Name: _ce.s Value: v~141a2ddaffeb5f7a25035c4a12e60aca83b92e35~lcw~1726838115255~lva~1726838115123~vpv~0~v11.cs~424000~v11.s~5ff2b560-7752-11ef-a457-858b3a433dfa~lcw~1726838115255
www.fortinet.com/	1970-01-20 23:40:38	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1726838115277%7D
.fortinet.com/	1970-01-21 01:50:14	Name: _gcl_au Value: 1.1.997501737.1726838115
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_38BQ9XFDT4 Value: GS1.1.1726838115.1.0.1726838115.0.0.0
.fortinet.com/	1970-01-21 09:16:38	Name: _ga Value: GA1.1.775319313.1726838115
www.fortinet.com/	1970-01-21 09:16:38	Name: _omappvp Value: dsd3RhbC3yNpJvthQ3o9fnjwD3Vm33rhhiszGKiiE3Sdg1ldQESaRLF4oAyj9L6r17xiIigh69JUzPX8xTrXwLNZPv6QPLKj
www.fortinet.com/	1970-01-20 23:40:39	Name: _omappvs Value: 1726838115529
.techtarget.com/	1970-01-20 23:40:39	Name: __cf_bm Value: ShTKarmXD9cJzxEUGTu6O9niKb1.CTKyrtQwN6HZ_Oo-1726838115-1.0.1.1-1wmL2cVur7J45jwDHa0IlJ5SsgVnS6JV4tBCfAQ1yjbbN6l27T6DMQt2TwLCgy8DxADzL6Wq..C7Nr03XYc3Dg
.doubleclick.net/	1970-01-21 03:59:50	Name: receive-cookie-deprecation Value: 1
.www.fortinet.com/	1970-01-21 08:26:14	Name: WID_VISITOR_ID Value: 1726838116969626176
.doubleclick.net/	1970-01-21 09:16:38	Name: IDE Value: AHWqTUlES6QCIQfkAHuHQ-TrLAgDQ4HLJXABVaLyV4I8hubd0TXNYyCP0uzbE_Yj
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_JH142QCQCJ Value: GS1.1.1726838115.1.0.1726838115.0.0.0
abm-tracking.demandscience.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838116237
tracking.contanuity.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838116237
tracking.contanuity.com/	1970-01-21 09:16:38	Name: clientId Value: undefined
.bidr.io/	1970-01-21 09:09:11	Name: bito Value: AAF_7k7N2usAABTiiMx9tQ
.bidr.io/	1970-01-21 09:09:11	Name: bitoIsSecure Value: ok
.simpli.fi/	1970-01-20 23:50:42	Name: uid_syncd_secure Value: true
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALB Value: EPJZuuFSNS8ZP9kRbYhuvAyP9pHwrp/nqFKb0KpS7F+cycEthXM8LsvfEl7bJrIJ8GCZm3D82k9FaGlS5B4sx5iymwUiz0skVj9/SP+Vs+pWX9tf9MEJdvfYZwJkODeXCJqhzQqph6xtOZ5yh7CjqRIT1xz9ILOY1qzyMZ3+uFS5YIj/0MbsnaWxkcZG8X3uwnij31BOaEKuuSbQCcbHMcc9Fh4j9CGx
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALBCORS Value: IdUN9+1rrT49tJS9MzheIo0dtDucfmacJQQBNecCXMfXxTpBdIvAFkOCGp3jEo8uZdyX0QXc2bAhirbPDJmb8T9+3QlW5F3r47Fn6+zrx27NvXBYLbkan6Jev3LciBmG0klEFRGkJ1H07Ys/j3RaLc9ZNHpGoPUB17LJ0yhNu53D9huNQscwAON1HMI5dtyXAps1hSRA0Rx6VPxRu3FN9wkvIktifMHR
.adnxs.com/	1970-01-21 09:16:38	Name: receive-cookie-deprecation Value: 1
.doubleclick.net/	1970-01-21 00:23:50	Name: ar_debug Value: 1
.adnxs.com/	1970-01-21 01:50:14	Name: XANDR_PANID Value: bv9SPUmAE9tGWYy9evJE-YGpXNQL0n3Z9LDi6FhEbyfOTUUgMDvHFcQiZTehSnpYSEh3qxGADUtOXfN37kO5fVk74xT41hEeuB9jQCiUSSo.
.adnxs.com/	1970-01-21 01:50:14	Name: uuid2 Value: 6416071458244987647
.linkedin.com/	1970-01-21 01:50:14	Name: li_sugr Value: 79e15931-df7f-4717-bac4-54c8556ddc37
.linkedin.com/	1970-01-21 08:26:14	Name: bcookie Value: "v=2&3bdea2bd-75ad-4ae8-82cc-bef7c76c89a7"
.linkedin.com/	1970-01-20 23:42:04	Name: lidc Value: "b=OGST06:s=O:r=O:a=O:p=O:g=3081:u=1:x=1:i=1726838117:t=1726924517:v=2:sig=AQGKQY56nnSfu1Z-SEDRJbrsONbAZOMi"
.agkn.com/	1970-01-21 08:26:14	Name: ab Value: 0001%3A2vHbRlJjZpo7sWNw7KooLJpn2wzADUIs
.smaato.net/	1970-01-21 00:10:52	Name: SCM Value: 4fb91121a4
.smaato.net/	1970-01-21 00:10:52	Name: SCMco Value: 4fb91121a4
.smaato.net/	1970-01-21 00:10:52	Name: SCM1001136 Value: 4fb91121a4
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_TS Value: 1726838118099
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_DID Value: fd7041dd-ee21-4a12-a56d-fbb1300c32ea
.adnxs.com/	1970-01-21 01:50:14	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2E?gqOe]Z!]tbW8i_jC:lq+Z:3[>YXQT[OHg5SjN5#Owd(LXw$?sSjay][Nif3_*r$l_[GEC_YqmV3PVX23nXm/!2nzXe?kq@
.linkedin.com/	1970-01-21 00:23:50	Name: UserMatchHistory Value: AQLmHEAI6gMkOgAAAZIPkpbzFl3ry_Uqsr8bG9Ym8VZDbUX-tyoHVsHqGn0P71qno_b6x8Tz_gOh4Q
.linkedin.com/	1970-01-21 00:23:50	Name: AnalyticsSyncHistory Value: AQJVorxkqqBTRgAAAZIPkpbzIcmmqAU87v9GNW92hJ4Dved4IyWGC_l21_-SRoAl92u-tPV1acWgkjWWLlysZA
.3lift.com/	1970-01-21 01:50:14	Name: tluidp Value: 4176304254560129319586
.3lift.com/	1970-01-21 01:50:14	Name: tluid Value: 4176304254560129319586
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_3WAY_SYNCS Value:
.agkn.com/	1970-01-21 08:26:14	Name: u Value: C\|0AAAAAAAALoAx5gAAAAAA
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cc Value: JP
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cn Value: Japan
www.fortinet.com/	1970-01-20 23:42:06	Name: 6scexist Value: true
.openx.net/	1970-01-21 08:26:14	Name: i Value: 129c79ed-78ae-47da-a770-bd578fa96e8e\|1726838118
.fortinet.com/	1970-01-21 09:16:38	Name: nmstat Value: ceaa6c64-b6c0-241e-ee84-c98b4aa4a9b3
.crwdcntrl.net/	1969-12-31 23:59:59	Name: _cc_cc Value: ctst
.www.linkedin.com/	1970-01-21 08:26:14	Name: bscookie Value: "v=1&2024092013151868d7e4b5-fabd-467d-8feb-eb22e830336eAQFfHw8ujHY6NL1GjhYHlAHAWzIPdFeq"
.bluekai.com/	1970-01-21 04:01:16	Name: bku Value: blx99sjNfVRlZM1q
.connatix.com/	1970-01-21 00:23:50	Name: cnx_userId Value: 5ec72b46fa0d44c78f650c7ba2f358db
.t.co/	1970-01-21 09:16:38	Name: muc_ads Value: a63bea62-0a97-4678-90c7-6191c9a32fcc
.t.co/	1970-01-20 23:40:39	Name: __cf_bm Value: 1ivBFWxnaIemGx1x7i_R0hhwFV_QbywWRcknqbmBzik-1726838118-1.0.1.1-2w2ILrovyY.iVL3.1FqmJlxNrNb45nhv9mBYWRjYCy70fZNr6TV.GDU1U2fGFBOazYKAUf8UzisS62kt2xyCXA
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQ Value: B4lqTSwp81
.intentiq.com/	1970-01-21 09:16:38	Name: IQver Value: 1.9
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos Value: M1AQTVRT-1W-JWQ5
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos_p Value: M1AQTVRT-1W-JWQ5
.rubiconproject.com/	1970-01-21 01:50:14	Name: receive-cookie-deprecation Value: 1
.twitter.com/	1970-01-21 09:16:38	Name: personalization_id Value: "v1_6dwLG+wgcNs+1c5+wM7/2g=="
.lijit.com/	1970-01-21 08:26:14	Name: ljt_reader Value: JXQbAQZHQ9RXVdVCS8mO9J7X
.rlcdn.com/	1970-01-21 01:07:02	Name: pxrc Value: CObqtbcGEgUI6AcQABIGCOrcKhAA
.pro-market.net/	1970-01-21 03:59:50	Name: anProfile Value: "1u47ut077iftm+1+1f=1+1g=1+1j=12+rs=s+rt=2A001633012800040000000000000003+s2=(sk44ti)+vm=24-BA538520521648E9919712AEE5D583A8"
.pro-market.net/	1970-01-21 00:23:50	Name: anHistory Value: "1u47ut077iftm+2+!#6wM$z#T+g"
.intentiq.com/	1970-01-21 09:16:38	Name: IQPData Value: 533500330#1726838118571#0#1726838118571
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQCDate Value: 1726838118572
.intentiq.com/	1970-01-21 09:16:38	Name: CSDT Value: UEQ6MTAwNDNfMCZVT3Y2bEt3
.intentiq.com/	1970-01-21 09:16:38	Name: ASDT Value: 0
.lijit.com/	1970-01-21 08:26:14	Name: _ljtrtb_2 Value: BA538520521648E9919712AEE5D583A8
.exelator.com/	1970-01-21 02:33:26	Name: EE Value: "b36130c1813750b96573a52040962f52"
.bfmio.com/	1970-01-21 08:26:14	Name: __141_cid Value: BA538520521648E9919712AEE5D583A8
.bfmio.com/	1970-01-21 08:26:14	Name: __io_cid Value: 4604c656c8ad69f2413e8ce2718583685245296f
.fortinet.com/	1970-01-21 01:50:14	Name: _fbp Value: fb.1.1726838119006.70715150275902385
.ml314.com/	1970-01-21 08:26:14	Name: pi Value: 3647144418421506066
.ml314.com/	1970-01-21 00:00:47	Name: tp Value: 3%253B09%252F20%252F2024%2B13%253A15%253A19%253B0
.smartadserver.com/	1970-01-21 08:26:14	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 08:26:14	Name: pbw Value: %24b%3d16999%3b%24o%3d99999
.adsrvr.org/	1970-01-21 08:26:14	Name: TDID Value: a5773930-db33-43ae-8f4c-c85a5da03847
.eyeota.net/	1970-01-21 08:26:14	Name: mako_uid Value: 1920f929ba8-368e0000010e567d
.eyeota.net/	1970-01-20 23:40:38	Name: SERVERID Value: 22141~DM
.smartadserver.com/	1970-01-21 08:26:14	Name: pid Value: 2564136141098097634
.ml314.com/	1970-01-20 23:40:38	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.exelator.com/	1970-01-21 02:33:26	Name: udo Value: "gAAAAAQAAAUeKLUv%252FWAeBIUaAEauqUcAjaoO%252FDv9%252F826KjMHIDQ5WVQdipht7F4DdYR4EZS8Izl0%252F1I79fEkbPr5oC2WKmZbuUNI9fEnEqY1IoFTWRaIq8IfnoN1pJUAlgCRAK4djsi%252BO5Bjeyc5YzKNhNyjx8M7CfpOViAq%252BiEZeee87rrOj5VFdSWjDwjiPJ0TdTcONd6RSIZE3ETnnC0yRr8%252BHDnycEPOvJ4Q7%252FqIBLvO99fdDgieRKpKVyOxlXvC%252FwJYD%252Bp0BPhYKM8%252FlPj%252FiV9ZWVl5A%252F8PYMGrhLgnHGq8J5RdR0BkwDAAw8S%252FiFb1HmBPF7YQYzdRkNglMnYgF7OnCiT1sZYq0lJdW%252FYMPZyYakkyy5Ulwcgdgm2aB%252FZsJaxsB8bReqNtMplGa1C5bMqjBOJy0Noe7zq3Ra7Dy%252BRs09JEQvIOF%252FsImrgXUoXqVC%252BmhsafyGGl%252BnoifzDaG%252BPLQUvcoChypYTyVKooqoVpKNV3JPJvk1zXEY3xBjc470o80D1JrSqP9vQCLQpZawJrxHn9Q5L922PM2uhf2Dk%252BrgJPYtVfnXPG0Uo4kJc1%252BrJh9AWTs4vWOIwh2B9wYndhF1NDX%252BEIavoNcfDbYraZsgwnY3K2lZpmy3BIedNoeqNLWdMZjVTxKh4ogjmZhsXN8TqpqKpdUSMIXAw3nLbZvG1vLtMajuZw9gaT0dmWs22jbVyn4lVAnhGTs3%252BB4h%252FlRWRYMiwhLD%252FCPKXgWOoDhVmp0hszmUhwrG1NWKOoYPH%252FCQQ8gZ%252F4CYoKf5FpncEwSRc6o1oM00WDV0lX8xWLeJeMEYFB2aEg1LAoOzh8Ie7TOZELpVLXjzjmgWpRI7HRAzMsKSGlx7avTIPJjGzSlUVIipYmjOWKtWp5pl1aoqUz1ZqIhMBO5138f4Ei5dTKsKSYLRSUVEIoQAJCEERWHhFgPEodqRopiQvbAVSFC5NcX0GAJGl1kTSHgmhgBocXgydaMxBhesHiYENKW4i4dNmFEwEaULi4uKe60HttaaCmuYLM4hcPnQQz3y3FGKEUmLEzGMVAfAI8h3Z4Pb7BSgIaZeu7KKhzvSYKa4F54Opv9U6aE6DyzKVhLuHw8yHiq5ZHV8IC%252FOaG5H2tbpzj6Vm0axUVrAPKwtt85y4Z"
.exelator.com/	1970-01-21 02:33:26	Name: ud Value: "eJxrXxzq6XKLQSHJ2MzQ2CDZ0MLQ2NzUIMnSzNTcONHUyMDEwNLMKM3UaHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDIckl%252BUWb6Iq%252BAxUUpaQyLSopPBZ9kPwkALSMo6A%253D%253D"
.amazon-adsystem.com/	1970-01-21 04:18:33	Name: ad-id Value: A_HG_UkVREpGkbm24weQQEs
.amazon-adsystem.com/	1970-01-21 09:16:38	Name: ad-privacy Value: 0
.mountain.com/	1970-01-21 08:26:14	Name: guid Value: 62de3d2e-7752-11ef-ae8d-1df8c297f37c
.px.mountain.com/	1970-01-21 08:26:14	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjcyADEMjQ1MDCx2lMiUrIx0kLWA1BrUA7wQLdEYAAAA="
.mountain.com/	1970-01-21 08:26:14	Name: rt Value: "MzIzMzY6MTcyNjgzODEyMQ=="
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit_p Value: 1\|hpxhd2B/62KaCuYsxxJV5l7FX39k1/aSDVU5yf6fAWINIXVBPorKWn2f35FaxAWYaYMz07RQW92M1KxoLazIt04KBbjzRD/Y5dDZuxGLGk9GowyOfOLdkut8entXpbMrGLlBvLavYoxfSNcdrMXS9DQqd3iKYwX0SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit Value: 1\|hpxhd2B/62KaCuYsxxJV5l7FX39k1/aSDVU5yf6fAWINIXVBPorKWn2f35FaxAWYaYMz07RQW92M1KxoLazIt04KBbjzRD/Y5dDZuxGLGk9GowyOfOLdkut8entXpbMrGLlBvLavYoxfSNcdrMXS9DQqd3iKYwX0SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.pubmatic.com/	1970-01-21 01:50:14	Name: KRTBCOOKIE_377 Value: 6810-a5773930-db33-43ae-8f4c-c85a5da03847&KRTB&22918-a5773930-db33-43ae-8f4c-c85a5da03847&KRTB&22926-a5773930-db33-43ae-8f4c-c85a5da03847&KRTB&23031-a5773930-db33-43ae-8f4c-c85a5da03847
.pubmatic.com/	1970-01-21 00:23:50	Name: PugT Value: 1726780796
.adsrvr.org/	1970-01-21 08:26:14	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCNDi7O2J4Kw9EAUSEgoDYWFtEgsIypKRpNCtoT0QBRIVCgZnb29nbGUSCwjG05yFiuCsPRAFEhYKB3J1Ymljb24SCwjG9JyFiuCsPRAFEhYKB2JsdWVrYWkSCwjG3I-KiuCsPRAFEhcKCHB1Ym1hdGljEgsIypvxjYrgrD0QBRgFOAFCBCICCAE.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838116969626176&event_type=page_request&timestamp=1726838116&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838116969626176&event_type=page_request&timestamp=1726838117&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
401.tw
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
capi.connatix.com
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.agkn.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
epsilon.6sense.com
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.ad.smaato.net
s.amazon-adsystem.com
script.crazyegg.com
secure.adnxs.com
simage2.pubmatic.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.crwdcntrl.net
sync.intentiq.com
sync.smartadserver.com
t.co
tag.simpli.fi
tags.bluekai.com
tags.inzynk.io
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
us-u.openx.net
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.co.jp
www.google.com
www.googleadservices.com
www.googletagmanager.com
ad.doubleclick.net
b.6sc.co
tracking.contanuity.com
www.fortinet.com
100.20.58.101
103.43.90.179
103.43.90.21
104.18.41.104
104.19.148.8
104.244.42.131
13.107.42.14
13.112.211.211
13.228.141.56
13.48.36.94
142.250.196.130
142.250.196.98
142.250.76.131
142.251.222.36
142.251.42.136
142.251.42.162
151.101.228.157
157.240.31.5
162.159.140.229
172.105.230.106
172.217.161.34
172.217.26.230
172.67.163.237
18.139.230.53
18.182.162.20
207.65.34.80
23.106.127.57
23.32.225.140
23.36.17.70
23.50.118.161
2400:52e0:1501::1193:1
2404:6800:4004:818::2008
2404:6800:4004:823::200e
2404:6800:4004:825::2002
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
2600:140b:1a00:4::17c1:b893
2600:140b:1c00:39::1732:761f
2600:140b:a00:383::1e80
2600:1901:0:8eee::
2600:1f18:612b:4216:2684:b32f:7d35:8ca4
2600:9000:26f2:400:19:fc2c:a140:93a1
2600:9000:2751:ac00:12:dfa9:e200:93a1
2600:9000:27af:d400:1b:5138:8a40:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::ac40:9b77
2606:4700::6812:1247
2606:4700::6812:572a
2620:1ec:21::14
2620:1ec:33:1::10
2620:1ec:bdf::46
2a03:2880:f10f:187:face:b00c:0:25de
2a04:4e42:600::485
3.164.110.92
3.37.33.195
34.111.113.62
34.111.208.231
34.117.77.79
34.124.133.154
34.124.209.251
34.229.3.43
35.244.154.8
35.244.159.8
35.81.162.201
35.85.106.161
38.133.127.191
44.226.187.177
52.10.121.135
52.197.184.52
52.21.56.232
52.223.2.229
52.223.40.198
52.32.164.86
52.46.128.147
54.203.236.163
54.69.255.140
54.71.108.129
57.180.73.140
63.140.50.191
63.140.50.233
69.173.158.64
74.118.186.107
74.121.140.211
76.223.9.105
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
02576d342233ff22484a9efc5c729af4ff68e449f3751636e8bd5e8d3f5aa636
07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc
11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32
139123285e74312236c54dc1760f901619058e9fa98a2ecc75ee386cc7f578ea
15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd
1b622ff54d757665f5749cada9373b800806f3a18383a3cac151e8f02696d04f
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1fc1746d9732786881654c983bc92df005814f00263557d19305e70695ef6cf7
217ba4b460ea7bc3ea3dcf1e24b56335d36a7a70c748d3d778a00378918b0d30
21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5
229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f
23ef6d583ee52ee9caccce0ad5f20e08c0cf8007f7b16f37776abf51a446d6f2
2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938
291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63
2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde
2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e
2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb
3403d15e3aea027418cb9b1c77d34e60103de3156859b663956be5df10e331fb
351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
386e79737d293b51421c70a21f1b97bbee908dd648259abdf49cf411569eae31
38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66
3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
41859b2a0fc322848caf0994308be6207e431b91ccc2daa0208db837bc7890bb
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2
4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10
4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
503ca33d17d713049faf87601e9547fe25133948a3ffa6971ec7a9d75fff132b
5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d
59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0
5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c
5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436
5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417
609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d
61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce
6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6
6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d
6a29e5a99b4adc581751e179a332bd9eb793264c854d1334d5ff7d8c7284696f
6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712
6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc
718fb5c7b269a16b86bea00135647a151d77118f9e894156f259976d4b71ae44
71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1
7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94
8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421
83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012
8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e
851ca132408587ba49b24285fec021ca24075c2452acf8baddd03f5c5f30f245
88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3
89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7
8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196
8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978
8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
9294bc4573446dc911bda21aa48ea194d1ebcd30dab277169ed88a6d887b30d7
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369
9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4
9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36
9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94
9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5
a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a36d267af0824f0df68c73dfef7da4492ec4d90da8ccf9077303bf6279a44426
a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae7508b6af434ce1865c89b657732af23480ae3326b43fdcdcc43ac679723c10
ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302
af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd
b01d2140f69feac5a139b650e983d5750c4440787eaa00fbdc1f64f17b7df6ce
b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d
b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b4cf9a1c5e59761a8992b1692b7490a2c5bc428dfb4f84fc3b342edc51c8c06a
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf
d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f
d0c889c0237dcaf411c6e4bb40de96fb15f2cd0dac627cc124af397b9cedb27d
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f
d98d45daf1fc77cbdb8d3ec5d2b92d287cfa2dc94a385367b7655fc4daa1c7ef
da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda
daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dc90ea2d825c5f532a34e2a498ed6bfd5f3cd0cf7b3537fee7259831505790a1
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb
e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad
ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2
ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2
ee9baf9e36e9e7b53b1cbc5bb42d4f88567fb4b30d88558fc92423d50def6273
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e
f1d0599a803eb0bc984213e78d9f0ad1cefb2969b1fff4862df9ee0927d20df1
f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d
f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120
f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612
fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.fortinet.com Open in urlscan Pro 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

232 Requests

86 %HTTPS

27 %IPv6

64 Domains

91 Subdomains

74 IPs

7 Countries

6824 kBTransfer

10689 kBSize

115 Cookies

21 Outgoing links

Page URL History

Redirected requests

232 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Screenshot
Live screenshot

Full Image

232
Requests

86 %
HTTPS

27 %
IPv6

64
Domains

91
Subdomains

74
IPs

7
Countries

6824 kB
Transfer

10689 kB
Size

115
Cookies

232 HTTP transactions
2 data transactions