www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
Effective URL:
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Submission: On October 23 via api (October 23rd 2020, 8:12:54 pm UTC) from US

Summary HTTP 94 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 35 IPs in 6 countries across 32 domains to perform 94 HTTP transactions. The main IP is 13.56.33.144, located in San Jose, United States and belongs to AMAZON-02, US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 22nd 2019. Valid for: 2 years.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 3	96.45.36.159 96.45.36.159	40934 (FORTINET) (FORTINET)
1 23	13.56.33.144 13.56.33.144	16509 (AMAZON-02) (AMAZON-02)
9	2a02:26f0:10c... 2a02:26f0:10c:5b1::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 6	34.247.153.209 34.247.153.209	16509 (AMAZON-02) (AMAZON-02)
5	104.75.88.112 104.75.88.112	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
2	35.181.18.61 35.181.18.61	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	52.85.32.76 52.85.32.76	16509 (AMAZON-02) (AMAZON-02)
1	23.111.11.182 23.111.11.182	33438 (HIGHWINDS2) (HIGHWINDS2)
1	13.224.194.4 13.224.194.4	16509 (AMAZON-02) (AMAZON-02)
1	13.224.194.78 13.224.194.78	16509 (AMAZON-02) (AMAZON-02)
2	13.225.73.104 13.225.73.104	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1	34.240.31.203 34.240.31.203	16509 (AMAZON-02) (AMAZON-02)
3	23.111.11.71 23.111.11.71	33438 (HIGHWINDS2) (HIGHWINDS2)
2	52.202.69.186 52.202.69.186	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	2a02:26f0:10c... 2a02:26f0:10c:5a0::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 6	54.77.58.217 54.77.58.217	16509 (AMAZON-02) (AMAZON-02)
1	216.58.207.34 216.58.207.34	15169 (GOOGLE) (GOOGLE)
1 5	23.210.248.216 23.210.248.216	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2 2	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
2 2	52.30.187.36 52.30.187.36	16509 (AMAZON-02) (AMAZON-02)
2 2	52.30.140.199 52.30.140.199	16509 (AMAZON-02) (AMAZON-02)
1 2	52.57.150.20 52.57.150.20	16509 (AMAZON-02) (AMAZON-02)
1 2	3.248.28.111 3.248.28.111	16509 (AMAZON-02) (AMAZON-02)
1	35.174.151.106 35.174.151.106	14618 (AMAZON-AES) (AMAZON-AES)
1	34.196.88.42 34.196.88.42	14618 (AMAZON-AES) (AMAZON-AES)
94	35

3 96.45.36.159 (San Jose, United States) 2 redirects

ASN40934 (FORTINET, US)

blog.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
site.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 13.56.33.144 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-56-33-144.us-west-1.compute.amazonaws.com

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:10c:5b1::1e80 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.247.153.209 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-247-153-209.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.75.88.112 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.181.18.61 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.32.76 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-32-76.ham50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.182 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.194.4 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-4.fra2.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.194.78 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-78.fra2.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.73.104 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-104.fra2.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.240.31.203 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-31-203.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.111.11.71 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.202.69.186 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-1-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:5a0::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.77.58.217 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.207.34 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s24-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.216 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-216.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.207.148 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.187.36 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.140.199 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.150.20 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.248.28.111 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-28-111.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.174.151.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-4-ue1.aws.pardot.com

go.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.196.88.42 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-88-42.compute-1.amazonaws.com

nextroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	fortinet.com 3 redirects blog.fortinet.com www.fortinet.com metrics.fortinet.com site.fortinet.com go.fortinet.com	616 KB
9	adobedtm.com assets.adobedtm.com	78 KB
6	adroll.com 1 redirects s.adroll.com d.adroll.com	70 KB
6	ml314.com 1 redirects ml314.com	15 KB
6	demdex.net 2 redirects dpm.demdex.net fortinet.demdex.net	4 KB
5	googletagmanager.com www.googletagmanager.com	186 KB
5	omappapi.com api.omappapi.com a.omappapi.com	43 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	74 KB
4	addthis.com s7.addthis.com m.addthis.com	191 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	1 KB
2	eyeota.net 1 redirects ps.eyeota.net	1 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1009 B
2	adsrvr.org 2 redirects match.adsrvr.org	926 B
2	rlcdn.com 2 redirects idsync.rlcdn.com	800 B
2	facebook.com www.facebook.com	339 B
2	google.de www.google.de	584 B
2	google.com www.google.com	603 B
2	doubleclick.net googleads.g.doubleclick.net	2 KB
2	licdn.com snap.licdn.com	3 KB
2	facebook.net connect.facebook.net	91 KB
2	pardot.com pi.pardot.com	4 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	nextroll.com nextroll.com	2 KB
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	t.co t.co	170 B
1	twitter.com analytics.twitter.com	284 B
1	googleadservices.com www.googleadservices.com	11 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	addthisedge.com v1.addthisedge.com	787 B
1	opmnstr.com a.opmnstr.com	62 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	moatads.com z.moatads.com	1 KB
94	32

	Domain	Requested by
23	www.fortinet.com	1 redirects www.fortinet.com
9	assets.adobedtm.com	www.fortinet.com assets.adobedtm.com
6	ml314.com	1 redirects www.fortinet.com ml314.com
5	s.adroll.com	1 redirects www.fortinet.com s.adroll.com
5	www.googletagmanager.com	www.fortinet.com www.googletagmanager.com assets.adobedtm.com
5	dpm.demdex.net	2 redirects www.fortinet.com
3	a.omappapi.com	a.opmnstr.com
3	s7.addthis.com	assets.adobedtm.com s7.addthis.com
2	ps.eyeota.net	1 redirects
2	sync.crwdcntrl.net	2 redirects
2	match.adsrvr.org	2 redirects
2	idsync.rlcdn.com	2 redirects
2	www.facebook.com	connect.facebook.net
2	www.google.de
2	www.google.com
2	px.ads.linkedin.com	1 redirects
2	googleads.g.doubleclick.net	www.googleadservices.com
2	snap.licdn.com	www.fortinet.com snap.licdn.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	pi.pardot.com	www.fortinet.com pi.pardot.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	api.omappapi.com	a.opmnstr.com
2	metrics.fortinet.com	assets.adobedtm.com www.fortinet.com
2	blog.fortinet.com	2 redirects
1	nextroll.com
1	go.fortinet.com	pi.pardot.com
1	d.adroll.com
1	d.adroll.mgr.consensu.org	1 redirects
1	www.linkedin.com	1 redirects
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.fortinet.com
1	site.fortinet.com	www.fortinet.com
1	in.hotjar.com	script.hotjar.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	a.opmnstr.com	assets.adobedtm.com
1	static.hotjar.com	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	assets.adobedtm.com
1	z.moatads.com	s7.addthis.com
94	44

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.instagram.com
fortiguard.com
secure.fortinet.com
fusecommunity.fortinet.com
cookie-script.com
www.addthis.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-22` - `2021-03-31`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
metrics.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-29` - `2021-02-02`	2 years	crt.sh
*.hotjar.com Amazon	`2020-01-22` - `2021-02-22`	a year	crt.sh
*.opmnstr.com Go Daddy Secure Certificate Authority - G2	`2019-04-11` - `2021-04-11`	2 years	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.omappapi.com Go Daddy Secure Certificate Authority - G2	`2020-03-16` - `2022-03-16`	2 years	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2019-12-26` - `2020-12-26`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.ml314.com Amazon	`2020-02-17` - `2021-03-17`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2020-08-31` - `2020-11-29`	3 months	crt.sh
adroll.mgr.consensu.org Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
go.fortinet.com Let's Encrypt Authority X3	`2020-09-25` - `2020-12-24`	3 months	crt.sh
nextroll.com Let's Encrypt Authority X3	`2020-09-20` - `2020-12-19`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Frame ID: 5AF3317093F2635F4C7A47DAA7FB97C5
Requests: 92 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 47A415EC4F1EFCAC0D745E1BF4ADDCFC
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 3008ED5D088C3494CCC032B592207A3E
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: F244F5E96A7D57656003ABCDD73D8BD2
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 0DF4C4E8ABFD9592CBD4EFC8D1E1CF05
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1 Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

94
Requests

99 %
HTTPS

28 %
IPv6

32
Domains

44
Subdomains

35
IPs

6
Countries

1474 kB
Transfer

3899 kB
Size

21
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/SecureNetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/behindthefirewall/
Title:

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://secure.fortinet.com/fortiguard
Title: Threat Briefs

Search URL Search Domain Scan URL

URL: https://fusecommunity.fortinet.com/
Title: Fuse Community

Search URL Search Domain Scan URL

URL: https://cookie-script.com/
Title: Free cookie consent by cookie-script.com

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603483956344 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603483956344

Request Chain 30

https://cm.everesttech.net/cm/dd?d_uuid=07574253783117496760256882503270278702 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5M5NAAABn480S3- HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=X5M5NAAABn480S3-

Request Chain 75

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603483958650&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1603483958650%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fdeep-analysis-of-new-emotet-variant-part-1%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603483958650&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true

Request Chain 83

https://idsync.rlcdn.com/395886.gif?partner_uid=3614031787964497994 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxNDAzMTc4Nzk2NDQ5Nzk5NBAAGg0It_LM_AUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=99ab7bbc20ed3313b15f260365dbbbd3e96245fd82b3db77ad711a385e675f29f4cb09cee1a4f8eb&person_id=3614031787964497994&eid=50082

Request Chain 84

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=981ee893-97a7-4ce2-a320-6b735f7774d7 HTTP 302
https://ml314.com/csync.ashx?fp=981ee893-97a7-4ce2-a320-6b735f7774d7&person_id=3614031787964497994&eid=53819

Request Chain 85

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614031787964497994 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614031787964497994 HTTP 302
https://ml314.com/csync.ashx?fp=34a2e92581571b22c6c4633fb5817189&eid=50146&person_id=3614031787964497994

Request Chain 86

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

Request Chain 87

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 89

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=13603680139fa30b157c649a1280b542&_b=2 HTTP 302
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=13603680139fa30b157c649a1280b542&_b=2

94 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request deep-analysis-of-new-emotet-variant-part-1 Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
https://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
https://www.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

39 KB
14 KB

517ms
516ms

Document
text/html

13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d9975b62cb26a9dae9b2b0878ab302c37aec37c6f6b6fe2620d184cd7b8b76bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.fortinet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: cookiesession1=2C6411B9M7W4EK9DUNAOHLWUT0JSFB2F
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=600, public
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Fri, 23 Oct 2020 20:12:35 GMT
ETag: W/"9be7-5b25c339bdc49-gzip"
Last-Modified: Fri, 23 Oct 2020 20:12:36 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
Content-Length: 13605
Connection: keep-alive

Redirect headers

Content-Type: text/html; charset=iso-8859-1
Date: Fri, 23 Oct 2020 20:12:35 GMT
Location: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Dispatcher: dispatcher1uswest1
X-Vhost: publish
Content-Length: 296
Connection: keep-alive
Set-Cookie: cookiesession1=2C6411B9M7W4EK9DUNAOHLWUT0JSFB2F;Path=/;HttpOnly

GET
H/1.1 200
OK clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 217 KB
27 KB 459ms
245ms Stylesheet
text/css 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 27147
Last-Modified: Wed, 09 Sep 2020 21:01:42 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "36377-5aee7c22d9980-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 247 KB
60 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: fc5b6932c605af2013fb5ad7fb59d30d267a8a7623c352d1fddffe88bfce84ea

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:36 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:52 GMT
server: AkamaiNetStorage
status: 200
etag: "826090bcbe30f1049578ab162b96f733:1603326472.644124"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 60549
expires: Fri, 23 Oct 2020 21:12:36 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 731ms
180ms Image
image/svg+xml 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 1998
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "7ebb-565d53a1d6e40-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1131.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 11 KB
12 KB 770ms
195ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1131.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

2769ca5ab6b82d7e78029c047d2ad2c9509473541a3ddae53f3a07086a98c0a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:28:36 GMT
Server: Apache
ETag: "2de4-56f2d99142900"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 11748

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1132.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 24 KB
24 KB 895ms
220ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1132.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

9a79bdb5e88745d369e9a9916cf8ee11d6df45f02c5afff20a75386b1e99c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:34:54 GMT
Server: Apache
ETag: "5e4b-56f2daf9bfb80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 24139

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1133.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 3 KB
3 KB 925ms
219ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1133.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

0d32e1fbdf765264e5622fce18c8dff32ed318619d4d1b36cadb95d5d8ce8948

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:36:04 GMT
Server: Apache
ETag: "acd-56f2db3c81900"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 2765

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1134.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 7 KB
7 KB 921ms
189ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1134.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

c365e3170a06fdf90a7abceab2abf62c8aa658a870e7310d9041f6550cadd467

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:30:23 GMT
Server: Apache
ETag: "1a47-56f2d9f74d9c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 6727

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1135.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 12 KB
12 KB 324ms
260ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1135.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d73dc6d4597be4d66d2dbf8cd51e03251507a849c35bb5a1f97f0651fb438b91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:23:57 GMT
Server: Apache
ETag: "2fc8-56f2d8872f540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 12232

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1136.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 30 KB
31 KB 216ms
215ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1136.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

7ab56721300f018e546467bf273f8ddef14a3de34f96a7b46dec36c86cd16b0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:26:55 GMT
Server: Apache
ETag: "7927-56f2d930f05c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 31015

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1137.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 4 KB
4 KB 173ms
172ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1137.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

134597068595db606c339a0d5984297c453da7bd2d7888b4a8d59a912cf9a1e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:35:28 GMT
Server: Apache
ETag: "fdc-56f2db1a2c800"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 4060

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1138.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 20 KB
20 KB 211ms
211ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1138.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

f1a68763b703a2efc6d778b7c89565f48882d3e667051006420b4b1537e9a9a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:30:04 GMT
Server: Apache
ETag: "4f6a-56f2d9e52ef00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 20330

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1139.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 18 KB
18 KB 182ms
181ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1139.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

33379cd3124278877df5e3776a342e8282fb7bfd33edbdd131a1d80aec2dc6be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:27:54 GMT
Server: Apache
ETag: "4812-56f2d96934a80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 18450

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1140.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 16 KB
16 KB 182ms
182ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1140.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

797ac4f126723e434e5b1f5f857ce1d21fa34370030b679e21df00df3279ce19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:37:27 GMT
Server: Apache
ETag: "3e34-56f2db8ba93c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 15924

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1141.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 17 KB
17 KB 218ms
218ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1141.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

929d840a255355f0ef708b4ec54d37ab16392b8176a330dc97e0a2d34cfa8054

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:31:07 GMT
Server: Apache
ETag: "4264-56f2da2143cc0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 16996

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1142.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 6 KB
6 KB 188ms
188ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1142.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

05ea6f9aabf5fcf07b9a7724bc0ef9c4fa8d811b5df669112ae9124443a472aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:23:57 GMT
Server: Apache
ETag: "165c-56f2d8872f540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 5724

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1143.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 18 KB
18 KB 185ms
185ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1143.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

5cac00caee3e442510cda0c641976c0a5245acdbb7d6d853d74f3740b39f4b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:26:58 GMT
Server: Apache
ETag: "4687-56f2d933ccc80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 18055

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1144.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 37 KB
38 KB 290ms
290ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1144.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a579d3a189415086da085a6953df6f2929cc7cff093c6e83ee6d5f026b1d0505

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:36:07 GMT
Server: Apache
ETag: "959b-56f2db3f5dfc0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 38299

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603483956344
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603483956344

367 B
1 KB

108ms
108ms

XHR
application/json

34.247.153.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603483956344

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.153.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-153-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

c236f61147eebd35136da6b196e7e153d09643f50f4281372a4be4a2700ff6db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-07b12881e.edge-irl1.demdex.com 5.78.2.20201014153347 3ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: b4ZgJFDjTnc=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 303
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.fortinet.com
X-TID: 9VRyayiIRGg=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603483956344
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 11ms
10ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:36 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Fri, 23 Oct 2020 21:12:36 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 3 KB
2 KB 11ms
11ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:36 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1594
expires: Fri, 23 Oct 2020 21:12:36 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 49ms
49ms Script
application/javascript 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: "5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Fri, 23 Oct 2020 20:12:36 GMT
x-host: s7.addthis.com
content-length: 116324

GET
H/1.1 200
OK clientlib-base.min.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 167 KB
76 KB 533ms
196ms Script
application/javascript 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Fri, 23 Oct 2020 20:12:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
content-length: 77154
Last-Modified: Mon, 10 Aug 2020 17:22:54 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "29a67-5ac893472f780-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 55 KB
56 KB 198ms
195ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/deep-analysis-of-new-emotet-variant-part-2.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

b6c29512b7d321aa70701ef365f1f6c7ea25dff345206a54e5304216135f3e38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:32:06 GMT
Server: Apache
ETag: "dde6-5673b5be4b580"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 56806

GET
H/1.1 200
OK deep-analysis-driver-based-mitm-malware-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/analysis_of_driver-based_mitm_malware_itranslator/ 164 KB
164 KB 203ms
201ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/analysis_of_driver-based_mitm_malware_itranslator/deep-analysis-driver-based-mitm-malware-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a1560ea49eefd10f77beb855f9d853044f12fb750f6abd421c93ae14253de8fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Sep 2018 20:50:10 GMT
Server: Apache
ETag: "28e6b-5762b6f81c480"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 167531

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 35 KB
35 KB 239ms
238ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:32:08 GMT
Server: Apache
ETag: "8a6d-5673b5c033a00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 35437

GET
H/1.1 200
OK german-speakers-targeted-by-spam-leading-to-ozone-rat.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 10 KB
11 KB 230ms
230ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/german-speakers-targeted-by-spam-leading-to-ozone-rat.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

c8396eddcbd575ce4aa7b0d95bf200dbe79434b74649a086f16a454daebc5677

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Fri, 23 Oct 2020 20:12:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:33:08 GMT
Server: Apache
ETag: "28d4-5673b5f96c100"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 10452

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 253ms
90ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: FBAF69B7861DE212
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=20355
accept-ranges: bytes
content-length: 948
x-amz-id-2: mINJDBnKUfP83RzDJ6hQaYSGPvMPOM770jd+gXVSD8LFScfPdVPaVzI4W2IwmrtEKhDna93Nv9A=

GET
H/1.1 200
OK Cookie set dest5.html
fortinet.demdex.net/ Frame 47A4 0
0 202ms
51ms Document
text/html 34.247.153.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.153.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-153-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: fortinet.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=07574253783117496760256882503270278702
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 15 Oct 2020 15:10:26 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=07574253783117496760256882503270278702;Path=/;Domain=.demdex.net;Expires=Wed, 21-Apr-2021 20:12:36 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: DcDOM8y1SiU=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics.fortinet.com/ 48 B
510 B 192ms
52ms XHR
application/x-javascript 35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.fortinet.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=07219220467868881000222509671822526374&ts=1603483956578

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

c187eb0cd52ad6d3648c6c1469df19fb8a6725205acc59882b1491abe1d1e0ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Fri, 23 Oct 2020 20:12:36 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-7dd9449d74-vttdz
vary: Origin
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=07574253783117496760256882503270278702
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5M5NAAABn480S3-
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=X5M5NAAABn480S3-

42 B
915 B

104ms
103ms

Image
image/gif

34.247.153.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=X5M5NAAABn480S3-

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.153.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-153-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-0430ed873.edge-irl1.demdex.com 5.78.2.20201014153347 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: +bY93EpXTmE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: mYHZwgGOQ5E=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=X5M5NAAABn480S3-
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 s08101932148306
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/ 43 B
329 B 45ms
45ms Image
image/gif 35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/s08101932148306?AQB=1&ndh=1&pf=1&t=23%2F9%2F2020%2022%3A12%3A36%205%20-120&mid=07219220467868881000222509671822526374&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Adeep-analysis-of-new-emotet-variant-part-1&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Adeep-analysis-of-new-emotet-variant-part-1&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:36 GMT
x-content-type-options: nosniff
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
status: 200
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 24 Oct 2020 20:12:36 GMT
server: jag
xserver: anedge-7dd9449d74-vqk25
etag: 3443455575425646592-4621439152678113718
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 22 Oct 2020 20:12:36 GMT

GET
H2 200 hotjar-1178304.js Show response
static.hotjar.com/c/ 4 KB
2 KB 214ms
75ms Script
application/javascript 52.85.32.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1178304.js?sv=6

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.32.76 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-32-76.ham50.r.cloudfront.net

Software

Resource Hash

add9109e7262564791ee1223e33ff6ee6b2f5d743d55307b8a97da43a7ee3f77

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14
x-cache: Hit from cloudfront
status: 200
content-length: 1689
access-control-allow-origin: *
x-cache-hit: 1
etag: W/5ea111ee16dd606ccd5f44885c6f9c03
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
cache-control: max-age=60
x-amz-cf-pop: HAM50-C1
x-amz-cf-id: pRtlxThfJoLCgqScoAWwgOIEVGASqEEQ3PComYqtnhxvTkTOAwwWPA==

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 210 KB
62 KB 305ms
110ms Script
application/javascript 23.111.11.182
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5474c8872e9ddf6d23aafbc1dd3d97580c3eb3cfaae5abccc6b110d680915756

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:37 GMT
content-encoding: gzip
last-modified: Fri, 23 Oct 2020 12:57:50 GMT
server: NetDNA-cache/2.2
x-amz-request-id: AA6FE5E96C1CA721
etag: W/"0a4570ca9d3d6d54d718e6ffcc6729c9"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: dd5Ct2U5YZqJa/foWpWFVD7Dg0J+OiBy5AnVRz7Vl1hoOYFyJy4C6H/Lk3Y6HMMBgyqKaZv0ivQ=
expires: Mon, 18 Oct 2021 20:12:37 GMT

GET
H2 200 RCc1e0e9525773456f8571be34d2bb1032-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 1 KB
803 B 11ms
10ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCc1e0e9525773456f8571be34d2bb1032-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 97e95fcc66a29acfd27e371656c24da14947aace63dfa4db95fa8482f8bfb4bc

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:37 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 536
expires: Fri, 23 Oct 2020 21:12:37 GMT

GET
H2 200 RCb652faf409a54c3db318899e2cbcc95c-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 881 B
719 B 11ms
11ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCb652faf409a54c3db318899e2cbcc95c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f692ee03941001acfb64ab453b8ad134f6d8b8927d29ef586ef052d848878cfd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:37 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 452
expires: Fri, 23 Oct 2020 21:12:37 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/ 2 KB
787 B 271ms
270ms Script
application/javascript 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:37 GMT
content-encoding: gzip
etag: 1861047380--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=59, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 580
x-akamai-path-stats: [1:12833:108167]

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 90 B
250 B 169ms
168ms Script
application/javascript 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f93393458dd8265&bkl=0&bl=1&pdt=2657&sid=5f93393458dd8265&pub=ra-5d48adfc650f1a9e&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fortinet.com&fp=blog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=java%20script%2Cscript%2Crat%2Cmalware%2Cexe%2Cjs%2Ctrojan%2Cthreat%20research%2Cwindows%2CThreat%20Research%2Cemotet&colc=1603483957405&jsl=1&uvs=5f93393434dbd477000&skipb=1&callback=addthis.cbs.jsonp__138648195727616440
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 21415e7f06bab77f5671d49aedc129b461d5731001a2f475833f9fbf2dda9b27

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 23 Oct 2020 20:12:37 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 90
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 3008 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame F244 0
0 34ms
33ms Document
text/html 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Fri, 23 Oct 2020 20:12:37 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 modules.b98d976b35a426609eb5.js Show response
script.hotjar.com/ 361 KB
71 KB 107ms
36ms Script
application/javascript 13.224.194.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.b98d976b35a426609eb5.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.194.4 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-194-4.fra2.r.cloudfront.net

Software

Resource Hash

4bd60fc7b2e0c630d954762ccb91f3aeca0836fbf313776be1e664821921a529

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 09:53:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37134
x-cache: Hit from cloudfront
status: 200
content-length: 72436
access-control-allow-origin: *
last-modified: Fri, 23 Oct 2020 09:49:39 GMT
etag: "5e236c4a7b222f7b0d0d60eecb9d7d12"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 d8eef512ab23f23f549b4cd25ac5328d.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: MpvjGxE1S9zrKnQ3J46lGXEP6arks_YSR-7dtleP8ZExRq5wdZdNEg==

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame 0DF4 0
0 332ms
101ms Document
text/html 13.224.194.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.194.78 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-78.fra2.r.cloudfront.net
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Response headers

status: 200
content-type: text/html
content-length: 851
date: Mon, 05 Oct 2020 13:02:45 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
last-modified: Mon, 05 Oct 2020 11:02:22 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: 95Br1LcCq9g9fE35IDB5_I559rdEczzWhXJm5LY5svFKcSgbVTBByQ==
age: 1580992

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 41ms
41ms Script
application/javascript 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Fri, 23 Oct 2020 20:12:37 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 39852 Show response
api.omappapi.com/v2/embed/ 21 KB
5 KB 174ms
113ms XHR
application/json 13.225.73.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.73.104 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-73-104.fra2.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 9b10abf6d444b80d370fa0641fa9cc25d353003d31ff60bbc60a9c37b84a9750

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: FRA2-C2
x-cache-status: HIT
x-cache: Miss from cloudfront
status: 200
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 45602
x-user-agent: standard--
last-modified: Fri, 16 Oct 2020 03:41:03 GMT
server: Pagely Gateway/1.5.1
etag: W/"86be8e88cc4ab784c976747902cb81c1"
vary: Accept-Encoding, User-Agent
content-type: application/json
via: 1.1 7158aa4ac648947d564b98d9769b5b2b.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account, X-User-Agent
access-control-allow-origin: *
x-amz-cf-id: XD9Hpy6k-29glpOpuZQMxpJb90npmcEJYxEe0wwycVABWdBfwtIn3g==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d7b144a39a2d1f833fd452dc44a83ea505f8946a426d177e2e99bc2efba44e48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:37 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37906
x-xss-protection: 0
last-modified: Fri, 23 Oct 2020 18:06:31 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Oct 2020 20:12:37 GMT

GET
H3-Q050 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 3409
date: Fri, 23 Oct 2020 19:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 23 Oct 2020 21:15:48 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
126 B 13ms
13ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=133852735&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&ul=en-us&de=UTF-8&dt=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1673151858&gjid=697393307&cid=1091983766.1603483958&tid=UA-767980-1&_gid=1505375652.1603483958&_r=1&gtm=2ouae1&z=1302439946

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1178304/ 178 B
321 B 197ms
73ms XHR
application/json 34.240.31.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1178304/visit-data?sv=6
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.b98d976b35a426609eb5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.240.31.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-31-203.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

GET
H2 200 json Show response
api.omappapi.com/v3/geolocate/ 559 B
967 B 112ms
112ms XHR
application/json 13.225.73.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v3/geolocate/json
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.73.104 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-73-104.fra2.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: fba0279a9181413dfe072f4b10d292567bcc547c8cb9084b35c3a2b72ee16790

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
via: 1.1 7158aa4ac648947d564b98d9769b5b2b.cloudfront.net (CloudFront)
x-cache-config: 0 0
x-amz-cf-pop: FRA2-C2
x-cache-status: BYPASS
x-cache: Miss from cloudfront
status: 200
content-length: 559
x-user-agent: standard--
server: Pagely Gateway/1.5.1
x-ratelimit-remaining: 999
content-type: application/json
access-control-allow-origin: *
x-ratelimit-reset: 1603484018
x-ratelimit-limit: 1000
x-pagely-debug: mainblock
x-amz-cf-id: 4anQKNkBjYN6qfNGmzJbStKklA8zvcCdPgLZkpHOWkh8RrDfqXK44w==

GET
H2 200 webfont.js Show response
a.omappapi.com/app/js/webfont/1.5.18/ 16 KB
7 KB 258ms
83ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 150598F21615D8E3
etag: W/"593e60ad549e46f8ca9a60755336c7df"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: VS6jMyDYuGBSrs+kNu57QzslaALXrQeZVXyTbUrxnBJDHMl2ha905GMwrhcN+OK/SgstnnHWXLg=
expires: Mon, 18 Oct 2021 20:12:38 GMT

GET
H2 200 moment.min.js Show response
a.omappapi.com/app/js/moment.js/2.24.0/ 52 KB
20 KB 313ms
138ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/moment.js/2.24.0/moment.min.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e22419e8154be2a34a950dbb4c4c448413751c53ef02f00c6c56af28aa2c4964

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: A1976B166879D4D1
etag: W/"761502841c035afcf6a9bdc5d0a20d11"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: RuPgLz2XK8jLQg7xFavH86se718KnydvfDIjRvs6wSFy5oyn8GhtkHX7HLhU7MAdEtQocG78l6w=
expires: Mon, 18 Oct 2021 20:12:38 GMT

GET
H2 200 moment-timezone-with-data-2012-2022.min.js Show response
a.omappapi.com/app/js/moment-timezone/0.5.23/ 32 KB
11 KB 75ms
75ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/moment-timezone/0.5.23/moment-timezone-with-data-2012-2022.min.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 23190e1539469cc8b5faccb038b260ccda2cc62672c70efa1900a51a8e3d1be5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: F6245B6D2A53E3F6
etag: W/"fb7fbe56bb07e1bb4ead7d6ef061dbac"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: tYhuZQr4Bcsf852LVq0qh0/HiyAA+RMuDxA/qDPAjfgeqDONAU1T989CvxJVZTyPfljIwftTh20=
expires: Mon, 18 Oct 2021 20:12:38 GMT

GET
H2 200 RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 1021 B
867 B 12ms
11ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 6071bd6cb72a22908968609c8f71c3a4c35d8a800167fd458542a32780445252

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 601
expires: Fri, 23 Oct 2020 21:12:38 GMT

GET
H2 200 RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 819 B
768 B 11ms
11ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9d1b840480f23fb32f2a58063761424456b59f139d4609b5e7b0610dd2fc6237

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 502
expires: Fri, 23 Oct 2020 21:12:38 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cdebb9617bcda474bd09c07b66bf49608fc1606962c8e837bdd4124a552b6355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37970
x-xss-protection: 0
last-modified: Fri, 23 Oct 2020 18:06:31 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Oct 2020 20:12:38 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06182b83bd033b6cda0e4e82b71d11a78d7e8b2641fe10109708664a2ca08760

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37966
x-xss-protection: 0
last-modified: Fri, 23 Oct 2020 18:06:31 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Oct 2020 20:12:38 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

504cb84b076d359d547193e04f2d82b90d79f7591c7218cad2fefda54a82ab02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37969
x-xss-protection: 0
last-modified: Fri, 23 Oct 2020 18:06:31 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Oct 2020 20:12:38 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f7453f56f31ea4a02de5fa02b986a20224ff7463d7bdeb19810e6c4edd02a6e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37951
x-xss-protection: 0
last-modified: Fri, 23 Oct 2020 18:06:31 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Oct 2020 20:12:38 GMT

GET
H2 200 RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 847 B
744 B 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a7f564316dc7303685d94451d6c9fc9dae613ec562b18a91c04ef32a63bd994

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 477
expires: Fri, 23 Oct 2020 21:12:38 GMT

GET
H2 200 RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 664 B
699 B 10ms
9ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e3921284615c40654c9e00e3c672b92a639096d4d3712274184344b371fbfda7

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 400
x-akamai-path-stats: [1:978:4294966318]
expires: Fri, 23 Oct 2020 21:12:38 GMT

GET
H/1.1 200 ipinfo Show response
site.fortinet.com/utilservice/ 206 B
738 B 560ms
186ms Script
application/json 96.45.36.159
FORTINET

General

Check archive.org

Show headers Download Go to

Full URL

https://site.fortinet.com/utilservice/ipinfo?site=fortinet.com&callback=jQuery22009098628023057398_1603483957393&_=1603483957394

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.45.36.159 San Jose, United States, ASN40934 (FORTINET, US),

Reverse DNS

Software

nginx/1.14.0 /

Resource Hash

2d53a587c19dfb1080fac0093d6fb5adff4600039d16692e10f6f15d8a59fd48

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .fortinet.com .myfortinet.com fortinet.my.salesforce.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' *.fortinet.com *.myfortinet.com fortinet.my.salesforce.com;
Server: nginx/1.14.0
Date: Fri, 23 Oct 2020 20:12:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/json;charset=UTF-8
Connection: keep-alive
Content-Length: 206
Front-End-Https: on

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 493ms
117ms Script
application/javascript 52.202.69.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.69.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-1-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:38 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: 4208770abb36eec2b2f3a1c951758cc1
Last-Modified: Fri, 13 Mar 2020 17:24:25 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Sun, 23 Oct 2022 20:12:38 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 88 KB
23 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23070
x-xss-protection: 0
pragma: public
x-fb-debug: +JMAohP279kilj8oXUjdQwQ36e08VoC6164JXPc2afkqc6I3sXh/B+fV/n4lTuoSQKli8+AGJWX9SIN1yhOYlg==
x-fb-trip-id: 2042748335
x-frame-options: DENY
date: Fri, 23 Oct 2020 20:12:38 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 42ms
41ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
age: 68770
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-fra19136-FRA
last-modified: Wed, 21 Oct 2020 21:46:56 GMT
x-timer: S1603483959.559998,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 12ms
9ms Script
application/x-javascript 2a02:26f0:10c:5a0::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5a0::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:38 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=63309
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 329ms
77ms Script
application/javascript 54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?239
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:37 GMT
Content-Encoding: gzip
Last-Modified: Fri, 23 Oct 2020 06:57:43 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=38704
Connection: keep-alive
Content-Length: 11933
Expires: Sat, 24 Oct 2020 06:57:43 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 30 KB
11 KB 63ms
62ms Script
text/javascript 216.58.207.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s24-in-f2.1e100.net

Software

cafe /

Resource Hash

0bfb81a6d3e2ed2e0cb381a9f933355ff00e64cd0d80724e83559861cad12711

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11472
x-xss-protection: 0
server: cafe
etag: 8286593240961886057
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 23 Oct 2020 20:12:38 GMT

GET
H2 200 177020962864941 Show response
connect.facebook.net/signals/config/ 234 KB
69 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

50767a5dcab4f4ae0aa05bb3bf246815cb41da175707ac7a39c837ded7e89250

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 69831
x-xss-protection: 0
pragma: public
x-fb-debug: NNmQ9wKLzSxKTwGtZQCRC//ZJRyVnQdWvcCZKvVGOMM+R/6jCDzJ6q/CfaMbOnmEKY9PT6MK1kp6Qwny1/pDdw==
x-fb-trip-id: 2042748335
x-frame-options: DENY
date: Fri, 23 Oct 2020 20:12:38 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 39 KB
13 KB 331ms
108ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: j1Ukz68kZImBJrgt6DlzhQICmRxkgWbz
Content-Encoding: gzip
ETag: "505601f096ee8dbb7ca2aafa3009e00c"
x-amz-request-id: 4A30A1DF02B82D40
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12342
x-amz-id-2: YGWnZLWp3a5Q/+XhlpjWllAZJKOHJKWeLtsAnTJqNwJQeVBUyMtnDCL6xRU42ao8VNLkNHGVEhY=
Last-Modified: Wed, 14 Oct 2020 20:21:11 GMT
Server: AmazonS3
Date: Fri, 23 Oct 2020 20:12:38 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 11ms
9ms Script
application/x-javascript 2a02:26f0:10c:5a0::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5a0::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:38 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=67117
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1603483958645&cv=9&fst=1603483958645&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

174bf2bb9a0cca13b60da4ec972461f3447ef03e8cf79b0cfe523caed15ff934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1088
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1603483958648&cv=9&fst=1603483958648&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6d4c5c47d219495e5c5fd472c46c1b7fd283c82d7c2cc461fca3521870c5d97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1089
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
284 B 216ms
216ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Fri, 23 Oct 2020 20:12:38 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: fc6a19190ac25fecd2efb291599372af
x-transaction: 00b6749600e6f417
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
170 B 155ms
154ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Fri, 23 Oct 2020 20:12:38 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: fabcb9d0c671439b127dbb0146e3c28e
x-transaction: 009c51be00cec358
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603483958650&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1603483958650%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603483958650&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true

0
64 B

175ms
175ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603483958650&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:39 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: XJN8Ryq4QBYgaZcB2CoAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: ApmAQCq4QBYQHp/mYCsAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: FA8A972FECAB406980D5A061B36B1517 Ref B: FRAEDGE1214 Ref C: 2020-10-23T20:12:38Z
x-frame-options: sameorigin
date: Fri, 23 Oct 2020 20:12:38 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603483958650&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
65 B 60ms
45ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1603483958645&cv=9&fst=1603483200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=2586831541&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/662878185/ 42 B
519 B 42ms
27ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/662878185/?random=1603483958645&cv=9&fst=1603483200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=2586831541&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
538 B 40ms
28ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1603483958648&cv=9&fst=1603483200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=383384825&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/609297413/ 42 B
65 B 41ms
28ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/609297413/?random=1603483958648&cv=9&fst=1603483200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=383384825&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
259 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&rl=&if=false&ts=1603483958702&sw=1600&sh=1200&v=2.9.27&r=stable&ec=0&o=30&fbp=fb.1.1603483958701.1061051392&it=1603483958608&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 20:12:38 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 23 Oct 2020 20:12:38 GMT

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 644 B
1 KB 76ms
75ms Script
application/javascript 54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&pv=1603483958863_jivp5ozcl&bl=en-us&cb=5514778&return=&ht=&d=&dc=&si=1603483958863_jivp5ozcl&cid=&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?239
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7adad8cc88d17e80aedc2dd9d703fcb3904784a89a85afd7b61c11ea53381641

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Oct 2020 20:12:38 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 468
Expires: 0

GET
H/1.1 200
OK ibs:dpid=22052&dpuuid=3614031787964497994&redir=
dpm.demdex.net/ 42 B
915 B 108ms
105ms Image
image/gif 34.247.153.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3614031787964497994&redir=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.153.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-153-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-013f845ae.edge-irl1.demdex.com 5.78.2.20201014153347 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: cr77dl5aQiQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3614031787964497994
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxNDAzMTc4Nzk2NDQ5Nzk5NBAAGg0It_LM_AUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=99ab7bbc20ed3313b15f260365dbbbd3e96245fd82b3db77ad711a385e675f29f4cb09cee1a4f8eb&person_id=3614031787964497994&eid=50082

43 B
312 B

77ms
77ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=99ab7bbc20ed3313b15f260365dbbbd3e96245fd82b3db77ad711a385e675f29f4cb09cee1a4f8eb&person_id=3614031787964497994&eid=50082
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:38 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 24 Oct 2020 16:12:39 GMT

Redirect headers

date: Fri, 23 Oct 2020 20:12:39 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=99ab7bbc20ed3313b15f260365dbbbd3e96245fd82b3db77ad711a385e675f29f4cb09cee1a4f8eb&person_id=3614031787964497994&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=981ee893-97a7-4ce2-a320-6b735f7774d7
https://ml314.com/csync.ashx?fp=981ee893-97a7-4ce2-a320-6b735f7774d7&person_id=3614031787964497994&eid=53819

43 B
312 B

80ms
80ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=981ee893-97a7-4ce2-a320-6b735f7774d7&person_id=3614031787964497994&eid=53819
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:38 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 24 Oct 2020 16:12:39 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 23 Oct 2020 20:12:38 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Location: https://ml314.com/csync.ashx?fp=981ee893-97a7-4ce2-a320-6b735f7774d7&person_id=3614031787964497994&eid=53819
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0,Sat, 24 Oct 2020 16:12:39 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614031787964497994
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614031787964497994
https://ml314.com/csync.ashx?fp=34a2e92581571b22c6c4633fb5817189&eid=50146&person_id=3614031787964497994

43 B
312 B

129ms
53ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=34a2e92581571b22c6c4633fb5817189&eid=50146&person_id=3614031787964497994
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:38 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 24 Oct 2020 16:12:39 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Oct 2020 20:12:39 GMT
status: 302
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ml314.com/csync.ashx?fp=34a2e92581571b22c6c4633fb5817189&eid=50146&person_id=3614031787964497994
cache-control: no-cache
x-server: 10.45.13.208
content-length: 0
expires: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

0
344 B

53ms
53ms

Image
text/plain

52.57.150.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.57.150.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:39 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /pixel/bounce/?pid=r8hrb20&t=gif
Date: Fri, 23 Oct 2020 20:12:39 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

88ms
88ms

Script
application/javascript

23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2U8XMvdFINXJNFsilaXONuSvqmREKV3.
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: 0A9DFB41B15EF3A2
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: 9wtYzl8isf76a+KTcCc0hWCh/ZKrxXSL0KsmsoDDvS1VGgWl/GxdSe7DtPnOmbh4BH+84jF1nEY=
Last-Modified: Fri, 31 Jul 2020 16:11:15 GMT
Server: AmazonS3
Date: Fri, 23 Oct 2020 20:12:39 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Fri, 23 Oct 2020 20:12:39 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/ 1 KB
1 KB 117ms
43ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: lB31ZYYh_0PrcEubGKOEYrsytQplmVqs
Content-Encoding: gzip
ETag: "3996d65282dd996ee0d7d4c90c139158"
x-amz-request-id: E468649EB3F88B98
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 635
x-amz-id-2: e12YhpgFKzZjr+nPzxpzUVK8TVbSoBB2LL5/rerV2B+iivAQjj8+9+qw86mryQVCyZmdQYAGOzY=
Last-Modified: Fri, 23 Oct 2020 05:47:53 GMT
Server: AmazonS3
Date: Fri, 23 Oct 2020 20:12:39 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=13603680139fa30b157c649a1280b542&_b=2
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=13603680139fa30b157c649a1280b542&_b=2

385 B
477 B

70ms
69ms

Script
application/javascript

3.248.28.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=13603680139fa30b157c649a1280b542&_b=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.28.111 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-28-111.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: feea8db65c729d3102aa662ede757c248df8105c77c4a9d16ae5553781520daa

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 23 Oct 2020 20:12:39 GMT
server: nginx/1.18.0
content-length: 385
content-type: application/javascript

Redirect headers

status: 302
date: Fri, 23 Oct 2020 20:12:39 GMT
server: nginx/1.18.0
content-length: 105
location: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=13603680139fa30b157c649a1280b542&_b=2

GET
H/1.0 200
OK analytics Show response
pi.pardot.com/ 2 KB
2 KB 301ms
300ms Script
text/javascript 52.202.69.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.69.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-1-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 02e37b0d469e6ee7ddb4615c6f286b61dab1428e26d267dde33015ed6f9252d5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Oct 2020 20:12:39 GMT
Content-Encoding: gzip
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: 4208770abb36eec2b2f3a1c951758cc1
X-Pardot-Rsp: 16/65/119
Vary: Accept-Encoding,User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 839
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
80 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryrfqPqq1Cn9p7zKls

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 23 Oct 2020 20:12:39 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fortinet.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 396 KB
55 KB 72ms
71ms Script
application/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: RrXoTAgO8kW4lHaNUHggiN0CFoNQqBuA
Content-Encoding: gzip
ETag: "14827d9b396da2c054681d43b60bfefa"
x-amz-request-id: 75FD1CF45B5DC603
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 55061
x-amz-id-2: 87Hntk1FQ9KerNTzh7kaTiGto6MGiLc0tqz1MqvwTE4/+GFSHUx4QutWa2o433BEieeasynzIjM=
Last-Modified: Wed, 21 Oct 2020 17:43:14 GMT
Server: AmazonS3
Date: Fri, 23 Oct 2020 20:12:39 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.0 200
OK analytics Show response
go.fortinet.com/ 52 B
1 KB 753ms
249ms Script
text/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.fortinet.com/analytics?conly=true&visitor_id=36337733&visitor_id_sign=095ef1e14727c637c7ec57caec2d83bc5ba3ed3e6973a6616503beb7ccd8e32ada81cb78512cb3429347a7614d4abd461ee4366f&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&url=https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&referrer=
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Oct 2020 20:12:39 GMT
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
X-Pardot-Rsp: 16/39/69
Vary: User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 52
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK favicon-32x32.png
nextroll.com/ 2 KB
2 KB 538ms
181ms Image
image/png 34.196.88.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextroll.com/favicon-32x32.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.88.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-88-42.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 23 Oct 2020 20:12:39 GMT
Via: 1.1 vegur
Last-Modified: Thu, 15 Oct 2020 16:16:02 GMT
Server: Apache
Etag: "64f-5b1b7f6d77480"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1615

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

194 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.fortinet.com/	1970-01-19 13:24:45	Name: _hjAbsoluteSessionInProgress Value: 0
www.fortinet.com/	1970-01-19 13:24:44	Name: _hjIncludedInSessionSample Value: 1
.demdex.net/	1970-01-19 17:43:55	Name: demdex Value: 12236392590620927340834168905024077484
.fortinet.com/	1970-01-20 06:55:55	Name: _ga Value: GA1.2.1091983766.1603483958
www.fortinet.com/	1970-01-23 13:23:17	Name: _omappvp Value: XoRXJzhFrKyarh9CRmNqbVdRwwI2VWVBTX5WsmMAk6m9jYvmbEYDldjZvnvI1W5ZaPi1kIH5mdvuRAW0CLC4qGDWGfjHjtRT
.fortinet.com/	1970-01-19 22:10:19	Name: _hjid Value: aa23c3a2-a0cb-4268-8dba-586b288dcd38
.addthis.com/	1970-01-19 22:55:01	Name: uvc Value: 1%7C43
www.fortinet.com/	1970-01-19 22:55:01	Name: __atuvc Value: 1%7C43
.fortinet.com/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1
.fortinet.com/	1970-01-19 13:26:10	Name: _gid Value: GA1.2.1505375652.1603483958
www.fortinet.com/	1970-01-19 13:24:44	Name: _omappvs Value: 1603483957924
www.fortinet.com/	1969-12-31 23:59:59	Name: cookiesession1 Value: 2C6411B99NGREDUWMLQM9PS8JHB84483
.fortinet.com/	1970-01-19 13:24:44	Name: _gat_gtag_UA_767980_1 Value: 1
.fortinet.com/	1970-01-20 06:55:55	Name: s_ecid Value: MCMID%7C07219220467868881000222509671822526374
.fortinet.com/	1970-01-19 13:24:45	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1
.addthis.com/	1970-01-19 22:55:01	Name: loc Value: MDAwMDBFVURFQkUyMzI1MTkzNDAwNjAwMDBDSA==
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-20 06:55:55	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 359503849%7CMCIDTS%7C18559%7CMCMID%7C07219220467868881000222509671822526374%7CMCAAMLH-1604088756%7C6%7CMCAAMB-1604088756%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1603491156s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18566%7CvVersion%7C5.0.1
.fortinet.com/	1970-01-19 15:34:19	Name: s_getNewRepeat Value: 1603483956775-New
www.fortinet.com/	1970-01-19 13:24:45	Name: __atuvs Value: 5f93393434dbd477000
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.omappapi.com
a.opmnstr.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
blog.fortinet.com
cm.everesttech.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dpm.demdex.net
fortinet.demdex.net
go.fortinet.com
googleads.g.doubleclick.net
idsync.rlcdn.com
in.hotjar.com
m.addthis.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
nextroll.com
pi.pardot.com
ps.eyeota.net
px.ads.linkedin.com
s.adroll.com
s7.addthis.com
script.hotjar.com
site.fortinet.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
sync.crwdcntrl.net
t.co
v1.addthisedge.com
vars.hotjar.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
s7.addthis.com
104.244.42.195
104.244.42.5
104.75.88.112
13.224.194.4
13.224.194.78
13.225.73.104
13.56.33.144
151.101.12.157
216.58.207.34
23.111.11.182
23.111.11.71
23.210.248.216
23.210.250.213
2620:1ec:21::14
2a00:1450:4001:806::2008
2a00:1450:4001:809::200e
2a00:1450:4001:818::2003
2a00:1450:4001:819::2004
2a00:1450:4001:820::2002
2a02:26f0:10c:5a0::25ea
2a02:26f0:10c:5b1::1e80
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9005
3.248.28.111
34.120.207.148
34.196.88.42
34.240.31.203
34.247.153.209
35.174.151.106
35.181.18.61
52.202.69.186
52.30.140.199
52.30.187.36
52.57.150.20
52.85.32.76
54.77.58.217
66.117.28.86
96.45.36.159
02e37b0d469e6ee7ddb4615c6f286b61dab1428e26d267dde33015ed6f9252d5
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
05ea6f9aabf5fcf07b9a7724bc0ef9c4fa8d811b5df669112ae9124443a472aa
06182b83bd033b6cda0e4e82b71d11a78d7e8b2641fe10109708664a2ca08760
0bfb81a6d3e2ed2e0cb381a9f933355ff00e64cd0d80724e83559861cad12711
0d32e1fbdf765264e5622fce18c8dff32ed318619d4d1b36cadb95d5d8ce8948
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131
133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb
134597068595db606c339a0d5984297c453da7bd2d7888b4a8d59a912cf9a1e1
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
174bf2bb9a0cca13b60da4ec972461f3447ef03e8cf79b0cfe523caed15ff934
1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3
21415e7f06bab77f5671d49aedc129b461d5731001a2f475833f9fbf2dda9b27
23190e1539469cc8b5faccb038b260ccda2cc62672c70efa1900a51a8e3d1be5
2769ca5ab6b82d7e78029c047d2ad2c9509473541a3ddae53f3a07086a98c0a8
2d53a587c19dfb1080fac0093d6fb5adff4600039d16692e10f6f15d8a59fd48
33379cd3124278877df5e3776a342e8282fb7bfd33edbdd131a1d80aec2dc6be
390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb
4bd60fc7b2e0c630d954762ccb91f3aeca0836fbf313776be1e664821921a529
504cb84b076d359d547193e04f2d82b90d79f7591c7218cad2fefda54a82ab02
50767a5dcab4f4ae0aa05bb3bf246815cb41da175707ac7a39c837ded7e89250
5474c8872e9ddf6d23aafbc1dd3d97580c3eb3cfaae5abccc6b110d680915756
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5cac00caee3e442510cda0c641976c0a5245acdbb7d6d853d74f3740b39f4b06
6071bd6cb72a22908968609c8f71c3a4c35d8a800167fd458542a32780445252
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
797ac4f126723e434e5b1f5f857ce1d21fa34370030b679e21df00df3279ce19
7ab56721300f018e546467bf273f8ddef14a3de34f96a7b46dec36c86cd16b0e
7adad8cc88d17e80aedc2dd9d703fcb3904784a89a85afd7b61c11ea53381641
7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
929d840a255355f0ef708b4ec54d37ab16392b8176a330dc97e0a2d34cfa8054
97e95fcc66a29acfd27e371656c24da14947aace63dfa4db95fa8482f8bfb4bc
9a79bdb5e88745d369e9a9916cf8ee11d6df45f02c5afff20a75386b1e99c67d
9a7f564316dc7303685d94451d6c9fc9dae613ec562b18a91c04ef32a63bd994
9b10abf6d444b80d370fa0641fa9cc25d353003d31ff60bbc60a9c37b84a9750
9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc
9d1b840480f23fb32f2a58063761424456b59f139d4609b5e7b0610dd2fc6237
a1560ea49eefd10f77beb855f9d853044f12fb750f6abd421c93ae14253de8fc
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a579d3a189415086da085a6953df6f2929cc7cff093c6e83ee6d5f026b1d0505
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
add9109e7262564791ee1223e33ff6ee6b2f5d743d55307b8a97da43a7ee3f77
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6c29512b7d321aa70701ef365f1f6c7ea25dff345206a54e5304216135f3e38
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
c187eb0cd52ad6d3648c6c1469df19fb8a6725205acc59882b1491abe1d1e0ad
c236f61147eebd35136da6b196e7e153d09643f50f4281372a4be4a2700ff6db
c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59
c365e3170a06fdf90a7abceab2abf62c8aa658a870e7310d9041f6550cadd467
c8396eddcbd575ce4aa7b0d95bf200dbe79434b74649a086f16a454daebc5677
cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d
cdebb9617bcda474bd09c07b66bf49608fc1606962c8e837bdd4124a552b6355
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d6d4c5c47d219495e5c5fd472c46c1b7fd283c82d7c2cc461fca3521870c5d97
d73dc6d4597be4d66d2dbf8cd51e03251507a849c35bb5a1f97f0651fb438b91
d7b144a39a2d1f833fd452dc44a83ea505f8946a426d177e2e99bc2efba44e48
d9975b62cb26a9dae9b2b0878ab302c37aec37c6f6b6fe2620d184cd7b8b76bd
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e22419e8154be2a34a950dbb4c4c448413751c53ef02f00c6c56af28aa2c4964
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3921284615c40654c9e00e3c672b92a639096d4d3712274184344b371fbfda7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f1a68763b703a2efc6d778b7c89565f48882d3e667051006420b4b1537e9a9a1
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f692ee03941001acfb64ab453b8ad134f6d8b8927d29ef586ef052d848878cfd
f7453f56f31ea4a02de5fa02b986a20224ff7463d7bdeb19810e6c4edd02a6e7
fba0279a9181413dfe072f4b10d292567bcc547c8cb9084b35c3a2b72ee16790
fc5b6932c605af2013fb5ad7fb59d30d267a8a7623c352d1fddffe88bfce84ea
feea8db65c729d3102aa662ede757c248df8105c77c4a9d16ae5553781520daa

www.fortinet.com Open in urlscan Pro 13.56.33.144 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

94 Requests

99 %HTTPS

28 %IPv6

32 Domains

44 Subdomains

35 IPs

6 Countries

1474 kBTransfer

3899 kBSize

21 Cookies

10 Outgoing links

Page URL History

Redirected requests

94 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Screenshot
Live screenshot

Full Image

94
Requests

99 %
HTTPS

28 %
IPv6

32
Domains

44
Subdomains

35
IPs

6
Countries

1474 kB
Transfer

3899 kB
Size

21
Cookies

94 HTTP transactions
2 data transactions