www.fortinet.com Open in urlscan Pro
18.156.16.255 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ftnt.net/6017zvUgR
Effective URL:
https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_mediu...
Submission: On January 05 via manual (January 5th 2023, 8:43:38 am UTC) from CH — Scanned from DE

Summary HTTP 37 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 11 IPs in 3 countries across 9 domains to perform 37 HTTP transactions. The main IP is 18.156.16.255, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 120607.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 15th 2022. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	107.23.241.99 107.23.241.99	14618 (AMAZON-AES) (AMAZON-AES)
5	18.156.16.255 18.156.16.255	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6810:9540	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.201.125.192 35.201.125.192	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:1b55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2600:9000:205... 2600:9000:2057:c00:0:f267:a5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a02:26f0:f70... 2a02:26f0:f700:481::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	184.30.220.95 184.30.220.95	16625 (AKAMAI-AS) (AKAMAI-AS)
1	37.252.171.53 37.252.171.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:11a... 2a02:26f0:11a:3a2::1c91	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	35.156.134.55 35.156.134.55	16509 (AMAZON-02) (AMAZON-02)
37	11

1 107.23.241.99 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-23-241-99.compute-1.amazonaws.com

ftnt.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.156.16.255 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-16-255.eu-central-1.compute.amazonaws.com

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.125.192 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 192.125.201.35.bc.googleusercontent.com

marvel-b2-cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1b55 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2057:c00:0:f267:a5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

marvel-b1-cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:f700:481::1e80 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 184.30.220.95 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-220-95.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.53 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:11a:3a2::1c91 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.156.134.55 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-134-55.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	6sc.co j.6sc.co — Cisco Umbrella Rank: 13944 c.6sc.co — Cisco Umbrella Rank: 18647 ipv6.6sc.co — Cisco Umbrella Rank: 14890 b.6sc.co — Cisco Umbrella Rank: 8973	14 KB
7	bc0a.com marvel-b2-cdn.bc0a.com — Cisco Umbrella Rank: 41088 marvel-b1-cdn.bc0a.com — Cisco Umbrella Rank: 35982	211 KB
6	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 500	100 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 682	117 KB
5	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 120607	156 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 19108	576 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 670	819 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 1036	303 B
1	ftnt.net 1 redirects ftnt.net	428 B
37	9

	Domain	Requested by
6	b.6sc.co
6	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
6	marvel-b1-cdn.bc0a.com	www.fortinet.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	www.fortinet.com	www.fortinet.com
2	epsilon.6sense.com	j.6sc.co
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	j.6sc.co	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	marvel-b2-cdn.bc0a.com	www.fortinet.com
1	ftnt.net	1 redirects
37	13

This site contains links to these domains. Also see Links.

Domain
training.fortinet.com
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.instagram.com
fortiguard.com
secure.fortinet.com
fortinet.sharepoint.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-15` - `2023-04-15`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
cdn.bc0a.com GTS CA 1D4	`2022-12-23` - `2023-03-23`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh
marvel-cdn.bc0a.com Amazon	`2022-03-11` - `2023-04-09`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
*.6sc.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-08` - `2023-03-11`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.6sense.com Amazon	`2022-05-31` - `2023-06-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Frame ID: 69195CF995AF8BD4CA3ABC0AE09838C0
Requests: 38 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New Variant of QakBot Being Spread by HTML File Attached to Phishing EmailsBack ButtonFilter Button

Page URL History Show full URLs

http://ftnt.net/6017zvUgR HTTP 301
https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_sou... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

37
Requests

100 %
HTTPS

45 %
IPv6

9
Domains

13
Subdomains

11
IPs

3
Countries

599 kB
Transfer

2001 kB
Size

8
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://training.fortinet.com/?utm_source=blog&utm_campaign=nse-institute
Title: NSE training

Search URL Search Domain Scan URL

URL: https://training.fortinet.com/local/staticpage/view.php?page=nse_1&utm_source=blog&utm_campaign=nse-1
Title: NSE 1 – Information Security Awareness

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.instagram.com/behindthefirewall/

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://secure.fortinet.com/fortiguard
Title: Threat Briefs

Search URL Search Domain Scan URL

URL: https://fortinet.sharepoint.com/sites/fuse
Title: Sharepoint (FUSE)

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ftnt.net/6017zvUgR HTTP 301
https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

37 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request new-variant-of-qakbot-spread-by-phishing-emails Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

http://ftnt.net/6017zvUgR
https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr

74 KB
22 KB

981ms
763ms

Document
text/html

18.156.16.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-16-255.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a655382e72959a3c86261569c54d4f74e7d9c9c1a5a85dc5df899a33f3e7d895

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 28073
Cache-Control: max-age=600, public
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 21747
Content-Type: text/html;charset=utf-8
Date: Thu, 05 Jan 2023 08:43:31 GMT
ETag: "12617-5f179c26782d0-gzip"
Last-Modified: Thu, 05 Jan 2023 00:55:38 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 25
Content-Type: text/html;charset=UTF-8
Date: Thu, 05 Jan 2023 08:43:31 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Pragma: no-cache
Server: nginx

GET
H/1.1 200
OK clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 530 KB
25 KB 168ms
165ms Stylesheet
text/css 18.156.16.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-16-255.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

ff9e37c85077ba53d42745d95c2961860b9c3fc66f1cf61e5a421d20d77a8f51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 05 Jan 2023 08:43:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Age: 4197886
X-Vhost: publish
Connection: keep-alive
Content-Length: 25458
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 25 Oct 2022 20:48:16 GMT
Server: Apache
ETag: "848b9-5ebe206fe0400-gzip"
Vary: Accept-Encoding,User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
8 KB 49ms
19ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Jan 2023 08:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: QpLkTroHlqrE0LequA2uwg==
age: 31881
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 7151
x-ms-lease-status: unlocked
last-modified: Tue, 03 Jan 2023 20:32:36 GMT
server: cloudflare
etag: 0x8DAEDC9A6CC54A5
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 1603ed6e-601e-0064-5ad1-1f6846000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 784aed469b53bb9d-FRA

GET
H2 200 marvel.js Show response
marvel-b2-cdn.bc0a.com/ 9 KB
4 KB 44ms
8ms Script
application/javascript 35.201.125.192
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://marvel-b2-cdn.bc0a.com/marvel.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 192.125.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 965fc05b277596a937ba9d14388799fd5217eb96179f0187b8b937347bdfaf59

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:42:55 GMT
content-encoding: gzip
age: 37
x-guploader-uploadid: ADPycdsp01KfeSCvdDyEMEc8Jq2b0BIifWUuJXq2CnGbUrKXpQJMs3mjCNODmABkE4IJOuEo6mv-phi-RuJ9AOo7JkmjnBjeXs15
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3217
last-modified: Wed, 01 Sep 2021 18:16:49 GMT
server: UploadServer
etag: "5a385b6f8bc7f4775b2ec7b66c0ec4c2"
vary: Accept-Encoding
x-goog-hash: crc32c=0X9o7A==, md5=Wjhbb4vH9HdbLse2bA7Ewg==
x-goog-generation: 1630520209881243
content-language: en
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 3217
accept-ranges: bytes
content-type: application/javascript
expires: Thu, 05 Jan 2023 09:42:55 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 159ms
159ms Image
image/svg+xml 18.156.16.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-16-255.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 05 Jan 2023 08:43:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Age: 15089272
X-Vhost: publish
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Content-Length: 1998
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
ETag: "7ebb-565d53a1d6e40-gzip"
Vary: Accept-Encoding,User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK clientlib-base.min.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 150 KB
69 KB 925ms
925ms Script
application/javascript 18.156.16.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-16-255.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

ab36b5eec40d8e1f42efb817d4d24fc12fe3269eabe29c5da2cd77f86103c71c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 05 Jan 2023 08:43:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Age: 4197902
X-Vhost: publish
Connection: keep-alive
Content-Length: 70009
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 17 Nov 2022 18:01:23 GMT
Server: Apache
ETag: "258b0-5edae608562c0-gzip"
Vary: Accept-Encoding,User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 4 KB
2 KB 30ms
16ms XHR
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Jan 2023 08:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: ypNp2Paf3c+p42YUXiXMnA==
age: 83572
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1413
x-ms-lease-status: unlocked
last-modified: Fri, 12 Feb 2021 00:26:33 GMT
server: cloudflare
etag: 0x8D8CEECD9FE5833
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 93b67c06-201e-016c-4ac1-113560000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 784aed47ad925be1-FRA
expires: Fri, 06 Jan 2023 08:43:32 GMT

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
37 KB 790ms
768ms Font
application/octet-stream 18.156.16.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-16-255.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Origin: https://www.fortinet.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 05 Jan 2023 08:43:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Age: 1697985
X-Vhost: publish
Connection: keep-alive
Content-Length: 37716
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
Server: Apache
ETag: "9354-5df4fa74ff980"
X-Frame-Options: SAMEORIGIN
Content-Type: application/octet-stream
Cache-Control: max-age=2000000, public
Accept-Ranges: bytes

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
303 B 53ms
24ms XHR
application/json 2606:4700::6812:1b55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1b55 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.fortinet.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 784aed47fd97914d-FRA
access-control-allow-headers: Content-Type

GET
H2 200 qakbot-variant-phishing-html-hero.jpg
marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/ 68 KB
69 KB 214ms
159ms Image
image/webp 2600:9000:2057:c00:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/qakbot-variant-phishing-html-hero.jpg
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c3c6ae4243ff88516fe341538150c036df947e5d30d55f26d923778e282d242

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: V.nyDiAt9HrCoHFbNDPJCuu_eABsB_TQ
date: Thu, 05 Jan 2023 08:43:33 GMT
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b844.cloudfront.net (CloudFront)
x-amz-request-id: CP705Q0SB1VM556A
x-amz-cf-pop: FRA6-C1
x-cache: RefreshHit from cloudfront
content-length: 69662
x-amz-id-2: R0FKXVjfhOa5VrnKGEN/rGg6JWyVXZe2Pj3xP+2KVH/gAQRiqICTbXzzYZzluhHiTx8dD1eivDo=
x-amz-expiration: expiry-date="Thu, 08 Aug 2024 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Tue, 19 Jul 2022 00:11:07 GMT
server: AmazonS3
etag: "a35d402f1e0c066cac8cfbd80f9ca0d3"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: PVIDUNLzPtDOLhgT4bkjSPqi-YpnRSALV95al4Ld6H_yFo-oYNk3Tg==

GET
H2 200 adobe-patches-new-thumb.jpg.thumb.319.319.png
marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/ 16 KB
17 KB 53ms
28ms Image
image/webp 2600:9000:2057:c00:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/adobe-patches-new-thumb.jpg.thumb.319.319.png
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f62c26d05097609b2562d154e4268c6d78b3824cd68691b4faaa8c6fcc3a3566

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 14:17:39 GMT
x-amz-version-id: g.d.wIMzex3TA3GMSe8zX0KOeFW.dwMv
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b844.cloudfront.net (CloudFront)
x-amz-request-id: 5N5W9MFKWVFKJT7N
x-amz-cf-pop: FRA6-C1
age: 66354
x-cache: Hit from cloudfront
content-length: 16794
x-amz-id-2: ybAGblo0Is8yQamDJ8TnHO2YrKjCCsqSy5wvQ79U2AK334Ug5NiyicKydYY+5DLDQTPKrcxPp7Y=
x-amz-expiration: expiry-date="Fri, 12 Jul 2024 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Wed, 22 Jun 2022 19:05:15 GMT
server: AmazonS3
etag: "13739085e8fd3ce25c4f855d76d31cae"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: z_hid4cRR5mXCwJMIUSxudjRTjbK1Q5IQGvCwp22WUCW8lF0p9aXHw==

GET
H2 200 follina-zero-day-thumb.jpg.thumb.319.319.png
marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/ 25 KB
25 KB 57ms
33ms Image
image/webp 2600:9000:2057:c00:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/follina-zero-day-thumb.jpg.thumb.319.319.png
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a15f8a27225e7f884086248678e0aa4a52307ed8e5c0418ecca6ac89da5fea05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: K1R7G3PWMcN8ctbFUFADlklN0PPHQJGT
date: Wed, 04 Jan 2023 19:54:57 GMT
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b844.cloudfront.net (CloudFront)
x-amz-request-id: NS75NRW1DD4AS6DF
x-amz-cf-pop: FRA6-C1
age: 46116
x-cache: Hit from cloudfront
content-length: 25106
x-amz-id-2: lVjRHEtuyWo+Cw/6MqGWRPKL0/0Z3JbyS2RDVDHYymAXOIDlPUGAn5er7Gw6/IyIsFDAfVvMrn8=
x-amz-expiration: expiry-date="Fri, 05 Jul 2024 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Wed, 15 Jun 2022 19:09:16 GMT
server: AmazonS3
etag: "285ac93b88bfd6d9799d6804ebc5c53d"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: crQR2zd5sYerXXz2gFVwzjspWbDimB7dQMdRcSGjKaysizGDvB-pHA==

GET
H2 200 nokoyama-variant-peers-thumb.jpg.thumb.319.319.png
marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/ 17 KB
17 KB 477ms
453ms Image
image/webp 2600:9000:2057:c00:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/nokoyama-variant-peers-thumb.jpg.thumb.319.319.png
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0e44648dd60bf6cd2dac3bf16abd83e3921242b39e51f2cc74d472814bc0b405

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: PchSuqauNS4gJgrljH6dZBuFC4S52YFh
date: Thu, 05 Jan 2023 08:43:33 GMT
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b844.cloudfront.net (CloudFront)
x-amz-request-id: VHDN0DZ6TPERY37B
x-amz-cf-pop: FRA6-C1
x-cache: RefreshHit from cloudfront
content-length: 17038
x-amz-id-2: KBlaatevZeEh4pLyF8ry6W8MlhbCW2Dsy2aLom0J3hH4TeJ+3Q6R5JEJ/EQ/9HBWMPPH3/Q0qXU=
x-amz-expiration: expiry-date="Thu, 13 Jun 2024 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Tue, 24 May 2022 06:54:44 GMT
server: AmazonS3
etag: "081e232a0e04cd48ad33c6b707bc9372"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: aSv8FTVhugslrlHXsD-phrEOTesT3M2nFKH4kfk-LJ8G-gO2-uXSpg==

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 17ms
17ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Jan 2023 08:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Bh9exWOPGIwRshWljrtlEw==
age: 33773
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 79698
x-ms-lease-status: unlocked
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
server: cloudflare
etag: 0x8D89735260901BC
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 33663e86-901e-00f9-756c-c41206000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 784aed481e33bb9d-FRA

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/ 62 KB
14 KB 31ms
30ms Fetch
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

047f3105c9c1c03b56fb255cbb8cbfbad3a41aeab4928d722f42be59e48175fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Jan 2023 08:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: PDee2klF9h+xwI77VTWe9Q==
age: 76188
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 14507
x-ms-lease-status: unlocked
last-modified: Fri, 12 Feb 2021 00:26:39 GMT
server: cloudflare
etag: 0x8D8CEECDD98A1AE
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 47e82304-701e-009e-078a-2ca1a1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 784aed484eed5be1-FRA
expires: Fri, 06 Jan 2023 08:43:32 GMT

GET
H2 200 otCenterRounded.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 9 KB
3 KB 20ms
20ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Jan 2023 08:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SH1nUCPouc1JVrHnvxpQbg==
age: 78470
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2857
x-ms-lease-status: unlocked
last-modified: Thu, 03 Dec 2020 02:42:51 GMT
server: cloudflare
etag: 0x8D89735210A49EB
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 32b9a0a7-201e-0041-0563-ccf0f5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 784aed488f7a5be1-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 16ms
16ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Jan 2023 08:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: zNsRoM1FEmsEgJoYMCNTng==
age: 15937
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 11755
x-ms-lease-status: unlocked
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
server: cloudflare
etag: 0x8D897352245C4EA
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 8c813869-c01e-00c8-2b6c-c449d1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 784aed488f7c5be1-FRA

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 img1.1.png
marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails/_jcr_content/root/responsivegrid/image.img.png/1658166579100/ 25 KB
25 KB 452ms
451ms Image
image/webp 2600:9000:2057:c00:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails/_jcr_content/root/responsivegrid/image.img.png/1658166579100/img1.1.png
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3361a0b57117305cdcdba4deb805e85c4192bfae2f60fe294f9dcccc385f4eb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: jPq.X9soGPsrc37R2kuLxunYXc7N8PWJ
date: Thu, 05 Jan 2023 08:43:34 GMT
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b844.cloudfront.net (CloudFront)
x-amz-request-id: 3N4CD0CGS044ZT7M
x-amz-cf-pop: FRA6-C1
x-cache: RefreshHit from cloudfront
content-length: 25268
x-amz-id-2: M5HNzTT+SZY0NH5xRP6664L3ToNmfpTt9YjWTdISFjR8oTpls0sOjNfqtwpsst3Gbm0d/T+tr58=
x-amz-expiration: expiry-date="Thu, 08 Aug 2024 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Tue, 19 Jul 2022 16:05:17 GMT
server: AmazonS3
etag: "dd4116c270d92ee1cbf3418c4654544d"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: kWRbNKPniintuoK3rjdz6L7YvZQUwjXP-3HMB_5a4D3CoulQmws_ZQ==

GET
H2 200 fig1.2.png
marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails/_jcr_content/root/responsivegrid/image_1478536344.img.png/1658166631656/ 54 KB
54 KB 158ms
157ms Image
image/webp 2600:9000:2057:c00:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails/_jcr_content/root/responsivegrid/image_1478536344.img.png/1658166631656/fig1.2.png
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eb7e231403cde0f8b491b43164d2e369314fd5b6943ea6e228de2e887023ff15

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: rOjSNyRvznZ9DCpxNbcttqroyzsgpDmP
date: Thu, 05 Jan 2023 08:43:34 GMT
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b844.cloudfront.net (CloudFront)
x-amz-request-id: MPRSERBRT96XP0CZ
x-amz-cf-pop: FRA6-C1
x-cache: RefreshHit from cloudfront
content-length: 54926
x-amz-id-2: dZF8nC+QnCkwXf+o4pzzlsmLH0X76GsLZTb0spM1i51Q2n89TOBO7Ugnk5SbOaABR9nnFfuzxYE=
x-amz-expiration: expiry-date="Thu, 08 Aug 2024 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Tue, 19 Jul 2022 16:06:46 GMT
server: AmazonS3
etag: "a70390283da3a906b633460711db0c0e"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 8B06xBCvcROHt3KSTNyCCV1JXUldXM_2nmixYs6RQw0Jsi72TvlnrA==

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 397 KB
84 KB 293ms
55ms Script
application/x-javascript 2a02:26f0:f700:481::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:481::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1abf98c822e4252888e4f3b5d0764b707ba8ba7e1e98637710a32263745f864e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:33 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 23:39:29 GMT
server: AkamaiNetStorage
etag: "4bb8b46a351baf8610462735724eae25:1671233969.483055"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 85457
expires: Thu, 05 Jan 2023 09:43:33 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 60ms
60ms Script
application/x-javascript 2a02:26f0:f700:481::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:481::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:33 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Thu, 05 Jan 2023 09:43:33 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 61ms
60ms Script
application/x-javascript 2a02:26f0:f700:481::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:481::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:33 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Thu, 05 Jan 2023 09:43:33 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 31 KB
10 KB 97ms
22ms Script
application/javascript 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails?utm_source=social&utm_medium=twitter-org&utm_campaign=sprinklr

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-220-95.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

eea93734d5f0032479fa252394415d53cbcd4e7bd6d54764543eaa8b7c9fd10c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Jan 2023 08:43:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 01 Dec 2022 20:20:43 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63890c9b-7ad6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 10143
expires: Thu, 05 Jan 2023 08:43:33 GMT

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4831d7b0e8ec/ 358 B
495 B 56ms
56ms Script
application/x-javascript 2a02:26f0:f700:481::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4831d7b0e8ec/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:481::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 96a0a8446e52dfe9a89306fa2d2e73d73cd4860e40e6dc025e0b1fb6f885ffc7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:33 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 23:39:30 GMT
server: AkamaiNetStorage
etag: "fa8052e918904f708961626b53623b5c:1671233970.410265"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 228
expires: Thu, 05 Jan 2023 09:43:33 GMT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
819 B 141ms
120ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 Jan 2023 08:43:33 GMT
AN-X-Request-Uuid: 7a8d0f78-198c-40b9-8ada-ee932f4768fa
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 217.64.151.31; 217.64.151.31; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
204 B 33ms
14ms XHR
text/html 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-220-95.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:33 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.fortinet.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 36 B
285 B 131ms
18ms XHR
text/html 2a02:26f0:11a:3a2::1c91
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a:3a2::1c91 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: bd55f76b6f85a33124fa5531b0b8b7c4294673402cd98c6c8b6f967847f7ef1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Jan 2023 08:43:33 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:20:3a00:1011:e18f:2a37:94aa
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 36
expires: Thu, 05 Jan 2023 08:43:33 GMT

GET
H2 200 RC3bae6526bab9473dbbab7449e16ead11-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4831d7b0e8ec/ 579 B
588 B 69ms
68ms Script
application/x-javascript 2a02:26f0:f700:481::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4831d7b0e8ec/RC3bae6526bab9473dbbab7449e16ead11-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:481::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cbc0422530c94733e45ac9ead6e3eadfca7e465fb801fcb173da713f784c4b10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:33 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 23:39:30 GMT
server: AkamaiNetStorage
etag: "fa8052e918904f708961626b53623b5c:1671233970.410265"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 321
expires: Thu, 05 Jan 2023 09:43:33 GMT

GET
H2 200 RCbaf67986c19d4c769d50278694e2f3c9-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4831d7b0e8ec/ 2 KB
957 B 65ms
64ms Script
application/x-javascript 2a02:26f0:f700:481::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4831d7b0e8ec/RCbaf67986c19d4c769d50278694e2f3c9-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:481::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 054f4dcf7000cb4478e45f637a922df4a62e6776ad07401c51c55b1481fb066f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:33 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 23:39:30 GMT
server: AkamaiNetStorage
etag: "fa8052e918904f708961626b53623b5c:1671233970.410265"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 689
expires: Thu, 05 Jan 2023 09:43:33 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
494 B 545ms
536ms Image
image/gif 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=64654f0f-a3b6-4291-84dd-b92ec2b96eba&session=ab63e6a2-13d0-4782-810d-043ce96f927e&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3a00%3A1011%3Ae18f%3A2a37%3A94aa%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20spreading%20a%20new%20variant%20of%20the%20information%20stealer%20and%20banking%20Trojan%20QakBot.%20Read%20our%20blog%20to%20learn%20how%20the%20QakBot%20variant%20operates.%20%22%2C%22keywords%22%3A%22email%20phishing%2Cphishing%2CThreat%20Research%2Cmalware%20analysis%2Chtml%22%2C%22title%22%3A%22New%20Variant%20of%20QakBot%20Being%20Spread%20by%20HTML%20File%20Attached%20to%20Phishing%20Emails%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-variant-of-qakbot-spread-by-phishing-emails%3Futm_source%3Dsocial%26utm_medium%3Dtwitter-org%26utm_campaign%3Dsprinklr&pageViewId=e427f197-a1f5-4860-8e5b-708bde6049de

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-220-95.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:34 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
494 B 537ms
537ms Image
image/gif 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=64654f0f-a3b6-4291-84dd-b92ec2b96eba&session=ab63e6a2-13d0-4782-810d-043ce96f927e&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A33%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20spreading%20a%20new%20variant%20of%20the%20information%20stealer%20and%20banking%20Trojan%20QakBot.%20Read%20our%20blog%20to%20learn%20how%20the%20QakBot%20variant%20operates.%20%22%2C%22keywords%22%3A%22email%20phishing%2Cphishing%2CThreat%20Research%2Cmalware%20analysis%2Chtml%22%2C%22title%22%3A%22New%20Variant%20of%20QakBot%20Being%20Spread%20by%20HTML%20File%20Attached%20to%20Phishing%20Emails%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-variant-of-qakbot-spread-by-phishing-emails%3Futm_source%3Dsocial%26utm_medium%3Dtwitter-org%26utm_campaign%3Dsprinklr&pageViewId=e427f197-a1f5-4860-8e5b-708bde6049de&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-220-95.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:34 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 726 B
576 B 22ms
9ms XHR
application/json 35.156.134.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.156.134.55 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-134-55.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9caa51975dc97351ceb4e544fab746be9aee637db3095652a84b8dc68241e6ec

Request headers

Referer: https://www.fortinet.com/
accept-language: de-DE,de;q=0.9
Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:34 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.fortinet.com
access-control-allow-credentials: true
content-length: 389

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ 0
0 37ms
8ms Preflight 35.156.134.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.156.134.55 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-134-55.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-max-age: 1800
date: Thu, 05 Jan 2023 08:43:34 GMT
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
495 B 262ms
261ms Image
image/gif 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=64654f0f-a3b6-4291-84dd-b92ec2b96eba&session=ab63e6a2-13d0-4782-810d-043ce96f927e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A33%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20spreading%20a%20new%20variant%20of%20the%20information%20stealer%20and%20banking%20Trojan%20QakBot.%20Read%20our%20blog%20to%20learn%20how%20the%20QakBot%20variant%20operates.%20%22%2C%22keywords%22%3A%22email%20phishing%2Cphishing%2CThreat%20Research%2Cmalware%20analysis%2Chtml%22%2C%22title%22%3A%22New%20Variant%20of%20QakBot%20Being%20Spread%20by%20HTML%20File%20Attached%20to%20Phishing%20Emails%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-variant-of-qakbot-spread-by-phishing-emails%3Futm_source%3Dsocial%26utm_medium%3Dtwitter-org%26utm_campaign%3Dsprinklr&pageViewId=e427f197-a1f5-4860-8e5b-708bde6049de&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-220-95.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
495 B 294ms
292ms Image
image/gif 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=64654f0f-a3b6-4291-84dd-b92ec2b96eba&session=ab63e6a2-13d0-4782-810d-043ce96f927e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A34%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20spreading%20a%20new%20variant%20of%20the%20information%20stealer%20and%20banking%20Trojan%20QakBot.%20Read%20our%20blog%20to%20learn%20how%20the%20QakBot%20variant%20operates.%20%22%2C%22keywords%22%3A%22email%20phishing%2Cphishing%2CThreat%20Research%2Cmalware%20analysis%2Chtml%22%2C%22title%22%3A%22New%20Variant%20of%20QakBot%20Being%20Spread%20by%20HTML%20File%20Attached%20to%20Phishing%20Emails%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-variant-of-qakbot-spread-by-phishing-emails%3Futm_source%3Dsocial%26utm_medium%3Dtwitter-org%26utm_campaign%3Dsprinklr&pageViewId=e427f197-a1f5-4860-8e5b-708bde6049de&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-220-95.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:36 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
495 B 269ms
268ms Image
image/gif 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=64654f0f-a3b6-4291-84dd-b92ec2b96eba&session=ab63e6a2-13d0-4782-810d-043ce96f927e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A35%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%223008%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20spreading%20a%20new%20variant%20of%20the%20information%20stealer%20and%20banking%20Trojan%20QakBot.%20Read%20our%20blog%20to%20learn%20how%20the%20QakBot%20variant%20operates.%20%22%2C%22keywords%22%3A%22email%20phishing%2Cphishing%2CThreat%20Research%2Cmalware%20analysis%2Chtml%22%2C%22title%22%3A%22New%20Variant%20of%20QakBot%20Being%20Spread%20by%20HTML%20File%20Attached%20to%20Phishing%20Emails%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-variant-of-qakbot-spread-by-phishing-emails%3Futm_source%3Dsocial%26utm_medium%3Dtwitter-org%26utm_campaign%3Dsprinklr&pageViewId=e427f197-a1f5-4860-8e5b-708bde6049de&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-220-95.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:37 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
495 B 214ms
213ms Image
image/gif 184.30.220.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=64654f0f-a3b6-4291-84dd-b92ec2b96eba&session=ab63e6a2-13d0-4782-810d-043ce96f927e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2005%20Jan%202023%2008%3A43%3A36%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224010%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20spreading%20a%20new%20variant%20of%20the%20information%20stealer%20and%20banking%20Trojan%20QakBot.%20Read%20our%20blog%20to%20learn%20how%20the%20QakBot%20variant%20operates.%20%22%2C%22keywords%22%3A%22email%20phishing%2Cphishing%2CThreat%20Research%2Cmalware%20analysis%2Chtml%22%2C%22title%22%3A%22New%20Variant%20of%20QakBot%20Being%20Spread%20by%20HTML%20File%20Attached%20to%20Phishing%20Emails%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-variant-of-qakbot-spread-by-phishing-emails%3Futm_source%3Dsocial%26utm_medium%3Dtwitter-org%26utm_campaign%3Dsprinklr&pageViewId=e427f197-a1f5-4860-8e5b-708bde6049de&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.220.95 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-220-95.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 05 Jan 2023 08:43:38 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-20 17:27:24	Name: cookiesession1 Value: 678A3E262C38A84DCCFBD6F4F823B4FB
.fortinet.com/	1970-01-20 17:27:24	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Thu+Jan+05+2023+08%3A43%3A33+GMT%2B0000+(GMT)&version=6.10.0&hosts=&consentId=3134e42e-c0fe-4ea4-ac34-5b66477ea2b2&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-variant-of-qakbot-spread-by-phishing-emails%3Futm_source%3Dsocial%26utm_medium%3Dtwitter-org%26utm_campaign%3Dsprinklr&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
www.fortinet.com/	1970-01-20 08:41:50	Name: aa_cc Value: DE
www.fortinet.com/	1970-01-20 08:41:50	Name: aa_cn Value: DE
www.fortinet.com/	1970-01-20 18:17:48	Name: _gd_visitor Value: 64654f0f-a3b6-4291-84dd-b92ec2b96eba
www.fortinet.com/	1970-01-20 08:42:02	Name: _gd_session Value: ab63e6a2-13d0-4782-810d-043ce96f927e
www.fortinet.com/	1970-01-20 08:51:53	Name: _an_uid Value: 0
.6sc.co/	1970-01-20 18:17:48	Name: 6suuid Value: 2484140272220000b68db663ef01000017a56b00

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
b.6sc.co
c.6sc.co
cdn.cookielaw.org
epsilon.6sense.com
ftnt.net
geolocation.onetrust.com
ipv6.6sc.co
j.6sc.co
marvel-b1-cdn.bc0a.com
marvel-b2-cdn.bc0a.com
secure.adnxs.com
www.fortinet.com
107.23.241.99
18.156.16.255
184.30.220.95
2600:9000:2057:c00:0:f267:a5c0:93a1
2606:4700::6810:9540
2606:4700::6812:1b55
2a02:26f0:11a:3a2::1c91
2a02:26f0:f700:481::1e80
35.156.134.55
35.201.125.192
37.252.171.53
047f3105c9c1c03b56fb255cbb8cbfbad3a41aeab4928d722f42be59e48175fb
054f4dcf7000cb4478e45f637a922df4a62e6776ad07401c51c55b1481fb066f
0e44648dd60bf6cd2dac3bf16abd83e3921242b39e51f2cc74d472814bc0b405
1abf98c822e4252888e4f3b5d0764b707ba8ba7e1e98637710a32263745f864e
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3361a0b57117305cdcdba4deb805e85c4192bfae2f60fe294f9dcccc385f4eb8
3c3c6ae4243ff88516fe341538150c036df947e5d30d55f26d923778e282d242
452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
965fc05b277596a937ba9d14388799fd5217eb96179f0187b8b937347bdfaf59
96a0a8446e52dfe9a89306fa2d2e73d73cd4860e40e6dc025e0b1fb6f885ffc7
9caa51975dc97351ceb4e544fab746be9aee637db3095652a84b8dc68241e6ec
a15f8a27225e7f884086248678e0aa4a52307ed8e5c0418ecca6ac89da5fea05
a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a
a655382e72959a3c86261569c54d4f74e7d9c9c1a5a85dc5df899a33f3e7d895
ab36b5eec40d8e1f42efb817d4d24fc12fe3269eabe29c5da2cd77f86103c71c
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bd55f76b6f85a33124fa5531b0b8b7c4294673402cd98c6c8b6f967847f7ef1c
cbc0422530c94733e45ac9ead6e3eadfca7e465fb801fcb173da713f784c4b10
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
eb7e231403cde0f8b491b43164d2e369314fd5b6943ea6e228de2e887023ff15
eea93734d5f0032479fa252394415d53cbcd4e7bd6d54764543eaa8b7c9fd10c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f62c26d05097609b2562d154e4268c6d78b3824cd68691b4faaa8c6fcc3a3566
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff9e37c85077ba53d42745d95c2961860b9c3fc66f1cf61e5a421d20d77a8f51

www.fortinet.com Open in urlscan Pro 18.156.16.255 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

37 Requests

100 %HTTPS

45 %IPv6

9 Domains

13 Subdomains

11 IPs

3 Countries

599 kBTransfer

2001 kBSize

8 Cookies

12 Outgoing links

Page URL History

Redirected requests

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
18.156.16.255 Public Scan

Screenshot
Live screenshot

Full Image

37
Requests

100 %
HTTPS

45 %
IPv6

9
Domains

13
Subdomains

11
IPs

3
Countries

599 kB
Transfer

2001 kB
Size

8
Cookies

37 HTTP transactions
2 data transactions