www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Submission: On October 14 via api (October 14th 2024, 7:41:05 am UTC) from IN — Scanned from US

Summary HTTP 236 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 72 IPs in 2 countries across 61 domains to perform 236 HTTP transactions. The main IP is 2600:1f18:1492:1701:a964:c08d:f5eb:b0c, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 120260.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
67	2600:1f18:149... 2600:1f18:1492:1701:a964:c08d:f5eb:b0c	14618 (AMAZON-AES) (AMAZON-AES)
6	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	2600:141b:1c0... 2600:141b:1c00:209f::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	35.173.146.122 35.173.146.122	14618 (AMAZON-AES) (AMAZON-AES)
1 1	18.209.125.30 18.209.125.30	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.39.248 63.140.39.248	14618 (AMAZON-AES) (AMAZON-AES)
4	104.19.147.8 104.19.147.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	23.200.88.71 23.200.88.71	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.51.57.192 23.51.57.192	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.86.70.109 34.86.70.109	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2607:f8b0:400... 2607:f8b0:4006:81d::2008	15169 (GOOGLE) (GOOGLE)
2	64.202.112.63 64.202.112.63	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48d1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	3.128.169.50 3.128.169.50	16509 (AMAZON-02) (AMAZON-02)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:81e::200e	15169 (GOOGLE) (GOOGLE)
2	2a02:6ea0:c45... 2a02:6ea0:c454::1	60068 (CDN77 _) (CDN77 _)
4	2607:f8b0:400... 2607:f8b0:4006:81f::2002	15169 (GOOGLE) (GOOGLE)
1	142.251.40.102 142.251.40.102	15169 (GOOGLE) (GOOGLE)
1 4	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
2	18.173.219.118 18.173.219.118	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1347	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:bdf::40 2620:1ec:bdf::40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	216.200.232.249 216.200.232.249	30419 (PAEDAE-INC) (PAEDAE-INC)
2	142.250.65.200 142.250.65.200	15169 (GOOGLE) (GOOGLE)
3	142.251.40.228 142.251.40.228	15169 (GOOGLE) (GOOGLE)
1	63.140.39.15 63.140.39.15	14618 (AMAZON-AES) (AMAZON-AES)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
1	34.238.149.65 34.238.149.65	14618 (AMAZON-AES) (AMAZON-AES)
1	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
1	2600:141b:1c0... 2600:141b:1c00:6::17df:d105	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	44.214.225.221 44.214.225.221	14618 (AMAZON-AES) (AMAZON-AES)
1 2	68.67.160.26 68.67.160.26	29990 (ASN-APPNEX) (ASN-APPNEX)
2 4	68.67.178.10 68.67.178.10	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:251... 2600:9000:2512:c600:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
22 25	35.194.66.159 35.194.66.159	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2600:9000:284... 2600:9000:2840:1400:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	20.33.59.55 20.33.59.55	8069 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	69.194.240.13 69.194.240.13	26120 (RHYTHMONE) (RHYTHMONE)
1 2	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4200:b056:b715:fbe2:c105	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	108.138.128.14 108.138.128.14	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:211... 2600:9000:211c:1c00:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2600:9000:284... 2600:9000:2840:2a00:1b:6b7d:2300:93a1	16509 (AMAZON-02) (AMAZON-02)
1	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	63.251.28.211 63.251.28.211	13789 (INTERNAP-...) (INTERNAP-BLK3)
2 3	2600:1901:0:8... 2600:1901:0:8eee::	15169 (GOOGLE) (GOOGLE)
3 3	142.251.32.98 142.251.32.98	15169 (GOOGLE) (GOOGLE)
1 2	50.16.197.56 50.16.197.56	14618 (AMAZON-AES) (AMAZON-AES)
1 2	3.225.218.10 3.225.218.10	14618 (AMAZON-AES) (AMAZON-AES)
1	52.70.179.249 52.70.179.249	14618 (AMAZON-AES) (AMAZON-AES)
1	23.46.225.71 23.46.225.71	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	54.159.12.227 54.159.12.227	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.204.30.191 34.204.30.191	14618 (AMAZON-AES) (AMAZON-AES)
3 3	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 6	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1	69.173.146.5 69.173.146.5	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1 1	2606:4700:440... 2606:4700:4400::6812:2929	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	142.250.65.230 142.250.65.230	15169 (GOOGLE) (GOOGLE)
2	157.240.241.1 157.240.241.1	32934 (FACEBOOK) (FACEBOOK)
1	172.67.163.237 172.67.163.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.156.2.105 54.156.2.105	14618 (AMAZON-AES) (AMAZON-AES)
5	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.94.188.245 3.94.188.245	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2 2	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2	35.85.106.161 35.85.106.161	16509 (AMAZON-02) (AMAZON-02)
236	72

67 2600:1f18:1492:1701:a964:c08d:f5eb:b0c (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2600:141b:1c00:209f::1e80 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.173.146.122 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-146-122.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.209.125.30 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-209-125-30.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.248 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-248.data.adobedc.net

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.147.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 23.200.88.71 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-88-71.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.51.57.192 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-51-57-192.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.86.70.109 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 109.70.86.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:81d::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.63 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48d1 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.128.169.50 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-128-169-50.us-east-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81e::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6ea0:c454::1 (New York, United States)

ASN60068 (CDN77 _, GB)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:81f::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.102 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.72.98 (Plainview, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.173.219.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-219-118.jfk52.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1347 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webtracker.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.232.249 (Frederick, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.200 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.40.228 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.15 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-15.data.adobedc.net

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.238.149.65 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-238-149-65.compute-1.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:6::17df:d105 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 44.214.225.221 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-214-225-221.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.26 (Colonia, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.178.10 (North Bergen, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2512:c600:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 35.194.66.159 (Washington, United States) 22 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 159.66.194.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2840:1400:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.33.59.55 (Washington, United States)

ASN8069 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

sync.inmobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.194.240.13 (United States)

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.139.29 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:b056:b715:fbe2:c105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.128.14 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-14.jfk50.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211c:1c00:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2840:2a00:1b:6b7d:2300:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.251.28.211 (Secaucus, United States)

ASN13789 (INTERNAP-BLK3, US)

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbid.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.32.98 (Queens, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.16.197.56 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-197-56.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.218.10 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-10.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.70.179.249 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-70-179-249.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.46.225.71 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-46-225-71.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.159.12.227 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-12-227.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.204.30.191 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-30-191.compute-1.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.154.8 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.254.65 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.130 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.146.5 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2929 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.230 (Plainview, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f6.1e100.net

10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.241.1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-lga3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.163.237 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.156.2.105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-156-2-105.compute-1.amazonaws.com

54.156.2.105	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.117.77.79 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.94.188.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-188-245.compute-1.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.40.198 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.85.106.161 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-85-106-161.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
68	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 120260 metrics.fortinet.com — Cisco Umbrella Rank: 303802	5 MB
27	simpli.fi 22 redirects tag.simpli.fi — Cisco Umbrella Rank: 4957 i.simpli.fi — Cisco Umbrella Rank: 4183 um.simpli.fi — Cisco Umbrella Rank: 913	15 KB
23	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 430	152 KB
17	6sc.co j.6sc.co — Cisco Umbrella Rank: 5626 c.6sc.co — Cisco Umbrella Rank: 6951 ipv6.6sc.co — Cisco Umbrella Rank: 5794 b.6sc.co — Cisco Umbrella Rank: 3611 eps.6sc.co — Cisco Umbrella Rank: 11869 v.eps.6sc.co — Cisco Umbrella Rank: 16729	23 KB
14	doubleclick.net 5 redirects td.doubleclick.net — Cisco Umbrella Rank: 192 ad.doubleclick.net — Cisco Umbrella Rank: 150 googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 cm.g.doubleclick.net — Cisco Umbrella Rank: 283 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 324916	7 KB
8	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 www.linkedin.com — Cisco Umbrella Rank: 646 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	4 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	744 KB
6	adnxs.com 3 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 267	6 KB
6	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2568 tracking.crazyegg.com — Cisco Umbrella Rank: 4786	41 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	ml314.com ml314.com — Cisco Umbrella Rank: 1614	40 KB
5	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3182 tr.outbrain.com — Cisco Umbrella Rank: 3133 wave.outbrain.com — Cisco Umbrella Rank: 3153	10 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579	10 KB
4	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 243 fortinet.demdex.net — Cisco Umbrella Rank: 337765	2 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 962	844 B
3	t.co t.co — Cisco Umbrella Rank: 859	1 KB
3	rlcdn.com 3 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 462	848 B
3	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2566 pbid.pro-market.net — Cisco Umbrella Rank: 9935	1 KB
3	mountain.com dx.mountain.com — Cisco Umbrella Rank: 4802 px.mountain.com — Cisco Umbrella Rank: 5019 gs.mountain.com Failed	10 KB
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 54170 tracking.contanuity.com — Cisco Umbrella Rank: 17825	1 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3	192 B
3	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 329188 pixels.argusplatform.com — Cisco Umbrella Rank: 327978 webtracker.argusplatform.com — Cisco Umbrella Rank: 334208	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25487 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23670	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 373 insight.adsrvr.org Failed	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	71 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 516	501 B
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 912	895 B
2	crwdcntrl.net 1 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 976	836 B
2	yahoo.com 1 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 495	502 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 1779	2 KB
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 993	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 542 d.agkn.com — Cisco Umbrella Rank: 782	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 446	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 415	970 B
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 51915	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6545 api.omappapi.com — Cisco Umbrella Rank: 6555	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 291663	149 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3660	12 KB
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 413	1 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 89	23 B
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 751	632 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 1137	27 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1507	421 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 576	653 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 867	550 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6710	175 B
1	1rx.io sync.1rx.io — Cisco Umbrella Rank: 503	99 B
1	inmobi.com sync.inmobi.com — Cisco Umbrella Rank: 1519	282 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 582	513 B
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 205998	442 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	14 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 3455	712 B
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 32696	17 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 316588	839 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	315 B
236	61

	Domain	Requested by
67	www.fortinet.com	www.fortinet.com
25	um.simpli.fi	22 redirects
23	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
10	b.6sc.co	www.fortinet.com
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
6	px.ads.linkedin.com	3 redirects snap.licdn.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	ml314.com	www.fortinet.com ml314.com
4	ib.adnxs.com	2 redirects
4	tags.srv.stackadapt.com	www.fortinet.com tags.srv.stackadapt.com
4	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
4	td.doubleclick.net	www.googletagmanager.com
4	script.crazyegg.com	www.fortinet.com script.crazyegg.com
3	analytics.twitter.com
3	t.co
3	idsync.rlcdn.com	3 redirects
3	cm.g.doubleclick.net	3 redirects
3	www.google.com	www.fortinet.com
3	bat.bing.com	assets.adobedtm.com bat.bing.com www.fortinet.com
3	dpm.demdex.net	www.fortinet.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	match.adsrvr.org	2 redirects
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	us-u.openx.net	1 redirects
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	ups.analytics.yahoo.com	1 redirects
2	loadm.exelator.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	pixel.tapad.com	1 redirects
2	eb2.3lift.com	1 redirects
2	secure.adnxs.com	1 redirects
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	v.eps.6sc.co	j.6sc.co
2	www.google-analytics.com	www.googletagmanager.com
2	eps.6sc.co	j.6sc.co
2	tracking.crazyegg.com	script.crazyegg.com
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	6033413.global.siteimproveanalytics.io
1	siteimproveanalytics.com	assets.adobedtm.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	pixel.rubiconproject.com
1	www.googleadservices.com	1 redirects
1	pippio.com	1 redirects
1	stags.bluekai.com
1	sync.bfmio.com
1	pbid.pro-market.net
1	ads.stickyadstv.com
1	image2.pubmatic.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.1rx.io
1	sync.inmobi.com
1	s.ad.smaato.net	1 redirects
1	tags.inzynk.io	assets.adobedtm.com
1	snap.licdn.com	www.fortinet.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	i.simpli.fi	tag.simpli.fi
1	webtracker.argusplatform.com	tmp.argusplatform.com
1	tracking.contanuity.com	abm-tracking.demandscience.com www.fortinet.com
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	pixels.argusplatform.com	tmp.argusplatform.com
1	metrics.fortinet.com	www.fortinet.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	ad.doubleclick.net	www.fortinet.com
1	a.opmnstr.com	assets.adobedtm.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
0	insight.adsrvr.org Failed
0	gs.mountain.com Failed	px.mountain.com
236	90

This site contains links to these domains. Also see Links.

Domain
forums.ivanti.com
www.horizon3.ai
www.cisa.gov
www.rapid7.com
www.fortiguard.com
www.linkedin.com
www.x.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-30`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
a.opmnstr.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
*.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
a.omappapi.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
omappapi.com WE1	`2024-10-12` - `2025-01-10`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-10-13` - `2025-01-11`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
*.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
pixels.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-08` - `2025-03-08`	6 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E6	`2024-08-15` - `2024-11-13`	3 months	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
webtracker.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M03	`2024-08-09` - `2025-09-06`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-07` - `2025-10-06`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-23` - `2024-10-21`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-08-19` - `2024-11-17`	3 months	crt.sh
54.156.2.105 Sectigo RSA Domain Validation Secure Server CA	`2024-01-25` - `2025-02-14`	a year	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M02	`2024-09-02` - `2025-10-01`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: C6DCF555CBAB66A7D292748EDC9C1A57
Requests: 227 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 10795C2D55727C75270333A0CC50EE9E
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=390758419.1728891659;ps=1;pcor=441157811;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: 6D486F44D51B4B8D86E19951FCB04250
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1728891659016&cv=11&fst=1728891659016&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 5545E296D926324D1BC1C0A56C1DCDD3
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1728891659075&cv=11&fst=1728891659075&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 4C1379AED4317CBCBB794D5141305B98
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1728891659127&cv=11&fst=1728891659127&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: FF588CF1E4F6FB35F305CD244CA4560C
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CIHjyqqvjYkDFc60WgUdOroMyg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6123577713429.3
Frame ID: 5C5EB7FE96211A5E7B28F01686EE3858
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA | FortiGuard Labs

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

236
Requests

85 %
HTTPS

30 %
IPv6

61
Domains

90
Subdomains

72
IPs

2
Countries

6463 kB
Transfer

10289 kB
Size

121
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190?language=de
Title: CVE-2024-8190

Search URL Search Domain Scan URL

URL: https://www.horizon3.ai/attack-research/cisa-kev-cve-2024-8190-ivanti-csa-command-injection/
Title: the details

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
Title: here

Search URL Search Domain Scan URL

URL: https://www.rapid7.com/blog/post/2024/01/11/etr-zero-day-exploitation-of-ivanti-connect-secure-and-policy-secure-gateways/
Title: here

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/threat-signal-report/5556
Title: https://www.fortiguard.com/threat-signal-report/5556

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56651
Title: https://www.fortiguard.com/encyclopedia/ips/56651

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.x.com/Fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76

https://cm.everesttech.net/cm/dd?d_uuid=69055857823743530071852983280508792246 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwzLCgAAAG22OQNw

Request Chain 151

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1728891659753 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1728891659753&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AAHCD07OGZYAABWr__X1lg

Request Chain 175

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 176

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 178

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://sync.inmobi.com/setuid?bidderID=82&dspUserId=1b9ed4174a

Request Chain 179

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/22F3E13362E54C0097F4EF24E93C1D50

Request Chain 180

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=22F3E13362E54C0097F4EF24E93C1D50&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=22F3E13362E54C0097F4EF24E93C1D50&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 181

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 182

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 183

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://d.agkn.com/pixel/10751/?che=1728891661241&ip=38.132.118.75&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214710605035006929096 HTTP 302
https://um.simpli.fi/aa_px?sk=214710605035006929096 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 184

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=22F3E13362E54C0097F4EF24E93C1D50&ckls=true&ci=xRJxG2LliC&nc=false&trid=-1509788642

Request Chain 185

https://um.simpli.fi/pubmatic HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:22F3E13362E54C0097F4EF24E93C1D50

Request Chain 186

https://um.simpli.fi/freewheel HTTP 302
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 187

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=22F3E13362E54C0097F4EF24E93C1D50;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=22F3E13362E54C0097F4EF24E93C1D50;mimetype=img;sr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=MzkzODg2MzU5NTg2Njk2Njg4OA== HTTP 302
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEP2g2OoX1eMKWcPHTfSX0-s&google_cver=1

Request Chain 188

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=22F3E13362E54C0097F4EF24E93C1D50&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=22F3E13362E54C0097F4EF24E93C1D50&j=0&xl8blockcheck=1

Request Chain 189

https://um.simpli.fi/yahoo HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=22F3E13362E54C0097F4EF24E93C1D50&verify=true

Request Chain 190

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 191

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 192

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 193

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=22F3E13362E54C0097F4EF24E93C1D50&dnr=1

Request Chain 194

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=22F3E13362E54C0097F4EF24E93C1D50 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogMjJGM0UxMzM2MkU1NEMwMDk3RjRFRjI0RTkzQzFENTAQABoNCI2Ws7gGEgUI6AcQAEIASgA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=9596a6e19ad87fee42fac89cba729f46d09b89da4c947fc432adc493b93778c9791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=9596a6e19ad87fee42fac89cba729f46d09b89da4c947fc432adc493b93778c9791426b5417dce21&rand=01622507

Request Chain 195

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1728891660782&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1476937846&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI55PDqq-NiQMV6htoCB0GKg2LMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=1476937846&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI55PDqq-NiQMV6htoCB0GKg2LMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfwsDyEt-0GKCaOTugcerKOQSBeGuqp4-KgYqAGJKQTe2l5ggQ&random=3462566639

Request Chain 197

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 198

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=22F3E13362E54C0097F4EF24E93C1D50&expires=365

Request Chain 199

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=22F3E13362E54C0097F4EF24E93C1D50

Request Chain 200

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEOmSAtrsDOH184eyr_m8fX4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=22F3E13362E54C0097F4EF24E93C1D50 HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 208

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1728891661028%26li_adsId%3Dce42842d-582b-4a08-a9a5-40f28c72133a%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true&e_ipv6=AQKCfk-aWeFTjQAAAZKJ-S0pbKh3hNqdz5BNZj5BVTZNRUchcNZpszOw-c2PaiV0hYMFefY

Request Chain 209

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6123577713429.3 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CIHjyqqvjYkDFc60WgUdOroMyg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6123577713429.3

Request Chain 223

https://idsync.rlcdn.com/395886.gif?partner_uid=3647695662085046304 HTTP 307
https://ml314.com/csync.ashx?fp=b1a1155fc2fd084729d512fbd833c1432d3c5e1525a8a51b9cb3ca8e2286f422f4cb09cee1a4f8eb&person_id=3647695662085046304&eid=50082

Request Chain 224

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=585ddd54-653f-45b5-89a6-52c1a07d3545&gdpr=0&gdpr_consent=

Request Chain 225

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647695662085046304%26eid=2 HTTP 302
https://ml314.com/csync.ashx?fp=5834751910482299011&person_id=3647695662085046304&eid=2

236 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa Show response
www.fortinet.com/blog/threat-research/ 133 KB
31 KB 492ms
64ms Document
text/html 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8e541dcf6b3eed0334c0309003af2e1851e7cf4d2d881b2f6d79819287fe15e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 223474
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 30532
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Mon, 14 Oct 2024 07:31:11 GMT
ETag: "213f6-62436ed025377-gzip"
Last-Modified: Fri, 11 Oct 2024 17:36:23 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
X-Amz-Cf-Id: OoMwqm5g_-8_cgc6-EYFP75g7HrlO2xDGgFJnu1WDCG5DT6U32BTgw==
X-Amz-Cf-Pop: IAD61-P4
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1-28559771
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 180ms
64ms Script
application/javascript 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 901804
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: LJnU_teWCJrSO7f4o9u3STzroaxOLEq2lr2YZ2i7_gdpu_Irmv-1vg==
Date: Mon, 14 Oct 2024 07:32:56 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 182ms
67ms Script
application/javascript 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 200623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: j8gpblvaUG_4BtHz2El1F721ccXRcdUGNVHyE85eJsjjTA9XLMCZLw==
Date: Fri, 11 Oct 2024 23:57:14 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 113ms
62ms Stylesheet
text/css 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58998583c0-gzip"
Age: 901801
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: RdOMTCBSUYyF8MTCOVT70pY1k41Huf8aSOLd91xY5qP2Ci6JZKos0w==
Date: Mon, 14 Oct 2024 07:33:24 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 21:00:07 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 111ms
42ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: uiXk8gw/ehyoMvZ3GeQiaQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCEA64C3FD6111
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 85476
x-content-type-options: nosniff
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/javascript
last-modified: Sat, 12 Oct 2024 02:22:48 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 497d4257-301e-00c3-2b15-1d1ac9000000
cf-ray: 8d25ec99ce2ea530-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7214
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 180ms
65ms Image
image/svg+xml 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 407308
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2ZfkwSi5MB0txNZRhuGNbaXhEJDWOqfGTiOyqHjC1rVjws7zUVHEiw==
Date: Wed, 09 Oct 2024 14:32:29 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 179ms
64ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 28908393
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: CpYBaTkM7QoHkWA8iphX-kRdPTvbL_U3ylPH0oMgZoHcJfJ3xRjkTQ==
Date: Mon, 14 Oct 2024 07:33:24 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 62ms
62ms Script
application/javascript 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 901796
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: kZNZdYjuDs5LnDt5nSeMuQ_tQKQceqB0I_tTQCOM5IjxkLP_4N4TeA==
Date: Mon, 14 Oct 2024 07:33:24 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 115ms
49ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 46137
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 15 Oct 2024 07:40:57 GMT
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 67257c4e-101e-0033-60c8-396628000000
cf-ray: 8d25ec9a9a0c336d-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK ivanti-hero.jpg
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 220 KB
222 KB 65ms
64ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/ivanti-hero.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3715e-6242cd5d60d40"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: K6eeudNbicGrv6yNh27SDoJThg8Oj1s1dMjVtuqf0aK675d_SN9QyA==
Date: Fri, 11 Oct 2024 17:45:35 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:34:05 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 225630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 146 KB
147 KB 60ms
59ms Image
image/png 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "24631-5e417b82eaa40"
Age: 36092923
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: eEkS69EcuBUUcP_IQG1oYCpg4Soq-XW2nQelHB3JViPLNEco15KLrA==
Date: Mon, 14 Oct 2024 07:40:55 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 17:30:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 149041
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ransomware-roundup-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 142 KB
144 KB 60ms
59ms Image
image/png 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/ransomware-roundup-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "23995-5e41c8188d9c0"
Age: 36094863
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: LQ-CYqaOWtnXVbYnEtOdOtrgb_BDG7Eiq1aPYk-a-snm9TANpY8VfA==
Date: Mon, 14 Oct 2024 07:40:56 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 23:12:47 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 145813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK MOVEIT-THUMB.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 124 KB
126 KB 60ms
60ms Image
image/png 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/MOVEIT-THUMB.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f0d8-5fd8fff10e040"
Age: 36094912
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: dclIYTEBS7edQv5doFtxJNL8DMtpzu6gLsSgtsQ_p3mjyBjeKCRdIw==
Date: Mon, 14 Oct 2024 07:40:56 GMT
Content-Type: image/png
Last-Modified: Wed, 07 Jun 2023 20:29:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 127192
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 63ms
59ms Font
application/octet-stream 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 895783
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 14_DRzo-g0VYIdnjNA9W_R_hL8GlZIOrwyOrLeiDPnTJkOfoQ6pjfg==
Date: Fri, 04 Oct 2024 00:03:55 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
315 B 121ms
45ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8d25ec9b69b1099e-MIA
access-control-allow-origin: *
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK ivanti-web-request-client-index.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ 46 KB
47 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ivanti-web-request-client-index.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b76f-6242bbea5e240"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: vwbAIKBxQ9w1brg5VSEEjrloQyCGoPBDAluM4DPVd2TCOESpQrg-WQ==
Date: Fri, 11 Oct 2024 17:52:04 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 46959
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig01-ivanti-gui-dl-landesk.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/ 93 KB
94 KB 62ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/fig01-ivanti-gui-dl-landesk.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1733a-6242bc1919080"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VxFs1Sq-jmrGJU1k9wI9Uj7VdFLXPuhvjvdZdGroPhNiOoYv5HomzA==
Date: Fri, 11 Oct 2024 17:52:04 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95034
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig02-ivanti-redirection-download.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/ 15 KB
16 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/fig02-ivanti-redirection-download.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3bfd-6242bc4ba47c0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7TAqTex-XURJsbFXOMSTz1bZ7L2G3AWxYSJB6Hmn8ibndugRKs1gEw==
Date: Fri, 11 Oct 2024 17:52:05 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:17:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig03-ivanti-redirection-ondemand.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/ 8 KB
9 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/fig03-ivanti-redirection-ondemand.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2011-6242bc7f24140"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: oFhHqJq5bV1fboXcouK77ybULXU1tCGlIYTi1MKV6WtfWepFlWVtyA==
Date: Fri, 11 Oct 2024 17:52:05 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:18:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 8209
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig04-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/ 44 KB
46 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/fig04-ivanti-code-vulnerable.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b104-6242bcacead40"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: e8Mac67XV7VRD1f_LkDN7jBuIs2VhP9OTTKC1vwW7nwjUkBIZtAkzA==
Date: Fri, 11 Oct 2024 17:52:05 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:19:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 45316
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-client-index-gsb-users.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ 17 KB
18 KB 62ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ivanti-client-index-gsb-users.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "43b0-6242bce717680"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2Dl8Vz1saAtvOIzObQRYwVNJhctbGzm8LeKIjB8K9WBHEcklaSatBQ==
Date: Fri, 11 Oct 2024 17:52:05 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:20:26 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 17328
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig05-ivanti-path-traversal.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/ 59 KB
60 KB 60ms
59ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/fig05-ivanti-path-traversal.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ebd4-6242bd3733380"
Age: 223432
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: BA4ZHVWux_KJXhA-6vzv7_2sezpBRHm6486KT2qt71Eag6BkJLVPuA==
Date: Fri, 11 Oct 2024 17:52:05 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:21:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 60372
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig06-ivanti-path-traversal-vulnerability.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/ 126 KB
127 KB 61ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/fig06-ivanti-path-traversal-vulnerability.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f626-6242bd6035440"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -aepWpIk1lDiSQ1VcO9iWDE2JAk0SvVhFbuPmxZ52jVkSrzdB1PYOQ==
Date: Fri, 11 Oct 2024 17:52:06 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:22:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 128550
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-csa-management-console.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ 31 KB
32 KB 61ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ivanti-csa-management-console.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ada-6242bd8566c00"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ocmWuNvLLR6lbngvFHVwNW6BEVTfuHQkKQNF7PDvRciEw3KjZOEVAg==
Date: Fri, 11 Oct 2024 17:52:06 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:23:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31450
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/ 173 KB
174 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2b2af-6242bdc17b9c0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: kVNTvRdisXUkM0zS4pwcBXlaLyZaUv2G6SCZKvMO7Xcrs_wxhkG5pg==
Date: Fri, 11 Oct 2024 17:52:06 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:24:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 176815
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig08-ivanti-setting-timezone-value.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/ 25 KB
26 KB 62ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/fig08-ivanti-setting-timezone-value.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "6205-6242bdf312ec0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: D9fXa9pXSyVjvuejEnjC_22SglwFfeixTUgq3rrFVgmoac5p4NCKcA==
Date: Fri, 11 Oct 2024 17:52:06 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:25:07 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 25093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig09-ivanti-vulnerabie-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/ 29 KB
31 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/fig09-ivanti-vulnerabie-function.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "758d-6242be296ef00"
Age: 223432
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 369ql8GD71cwCTBevv5OytKguqpy-GoFRU8de6WLJRqz546YHN2drg==
Date: Fri, 11 Oct 2024 17:52:06 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig10-ivanti-time-zone-change.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/ 58 KB
59 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/fig10-ivanti-time-zone-change.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e618-6242be5088b40"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: yN-F3jrKl0Wpm-Xc8eCOtuwMe4A9MvnZ0VXI-zYOpPYmIuaZzD2xCw==
Date: Fri, 11 Oct 2024 17:52:07 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58904
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig11-ivanti-post-variable-timezone.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/ 87 KB
89 KB 63ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/fig11-ivanti-post-variable-timezone.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15d27-6242be7a7ee40"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: C2ylzlklBwTNuVk0Y1qDVuI9dGEevwe7HppnvVdTGRvxIRoP95fY_g==
Date: Fri, 11 Oct 2024 17:52:07 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:27:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 89383
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig12-ivanti-decoded-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/ 112 KB
114 KB 61ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/fig12-ivanti-decoded-base64.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1c1e7-6242be9fb0600"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: z2VhkczdJSbfKnfxXrfeOFMLXyywpcAtssDv0GY5B14bk_LTcInqCQ==
Date: Fri, 11 Oct 2024 17:52:07 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115175
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig13-ivanti-broker-conf.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/ 31 KB
32 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/fig13-ivanti-broker-conf.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ab8-6242becf5f680"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: RAZA5ygtx6B4IvCQB-0EU9zYfgTS2vozWfWcgOWGw3UdA2iFqfysng==
Date: Fri, 11 Oct 2024 17:52:07 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31416
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig14-ivanti-root-user-private-key.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/ 11 KB
13 KB 59ms
59ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/fig14-ivanti-root-user-private-key.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2cda-6242bf01eadc0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 0fJ2gFM0E36iAZkkdbCa66uhcav1dlYXqiCIaObw2Ke_NPGrq27Ldg==
Date: Fri, 11 Oct 2024 17:52:07 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:29:51 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 11482
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig15-ivanti-postgres-database.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/ 96 KB
98 KB 61ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/fig15-ivanti-postgres-database.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "180ac-6242bf2257a40"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: EtyuSPdrpKBDgWFbQ_pY5hu2PuDJ_id0ddkRo8eaYjRj4_87O2xlfg==
Date: Fri, 11 Oct 2024 17:52:07 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:30:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 98476
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig16-ivanti-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/ 111 KB
112 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/fig16-ivanti-command-injection.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1bbea-6242bf4c4dd40"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: W8f3JAPhbjHV0ZHrHlb-D1rMTrRAwPQfKZ_0mB2IlwftvfqPZRovqA==
Date: Fri, 11 Oct 2024 17:52:08 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 113642
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-malicious-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ 16 KB
17 KB 61ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ivanti-malicious-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3ec2-6242bf6daec00"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: U6ERcU6jZYiqQFkGhiJbWXVRXse4odNeXiwZ6rt5iucY_Snuuw852w==
Date: Fri, 11 Oct 2024 17:52:08 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:44 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 16066
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig17-ivanti-command-injected.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/ 18 KB
19 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/fig17-ivanti-command-injected.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4858-6242bf8f0fac0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zd6EHj3vuFqnhWH9Mx5MN2kI3Fiwl8PvZ8xlNrz_6qsJ50Ok4riOCg==
Date: Fri, 11 Oct 2024 17:52:08 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:32:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18520
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig18-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/ 70 KB
71 KB 60ms
59ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/fig18-ivanti-code-vulnerable.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "11771-6242bfb9fa000"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: AmUQTPk0zJzoK_g0X7q4q3fGFkskwrQIwyFsf6yk3UPbb6u0iUWAAQ==
Date: Fri, 11 Oct 2024 17:52:08 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 71537
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig19-ivanti-update-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/ 55 KB
56 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/fig19-ivanti-update-function.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "da41-6242bfdf2b7c0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: WJS22O-lTD1ZUjH9CbF1hJISa7oBNeAuQIklUIi-hXj_F9PmgRMmJQ==
Date: Fri, 11 Oct 2024 17:52:08 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 55873
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig20-ivanti-files-patch.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/ 87 KB
88 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/fig20-ivanti-files-patch.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15a79-6242bffea4200"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Mf5LUuobtZQwuitmjIoKE5u5zO58ZRqLk6shWQNw2XcX6wWO2A6hng==
Date: Fri, 11 Oct 2024 17:52:08 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 88697
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig21-ivanti-patch-script.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/ 101 KB
103 KB 62ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/fig21-ivanti-patch-script.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1958b-6242c01e1cc40"
Age: 223432
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zd546d87xWz7oghtZX6HZCuCec5vmgy6m6rGQeH2pPt4uiAJEbgJLw==
Date: Fri, 11 Oct 2024 17:52:08 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 103819
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-temp-tmp-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ 29 KB
30 KB 61ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ivanti-temp-tmp-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "73b9-6242c0471ed00"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: AITUrjH_3uiNL7ZaO7ETIiCU28F-oLTnJI7joJG9NMxwkAKReQ7IQw==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:35:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29625
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig22-ivanti-patch-timestamp.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/ 22 KB
24 KB 62ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/fig22-ivanti-patch-timestamp.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "59be-6242c087f8600"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: CudAV1q5Nyn-ZUQok0_-nD8MdQesIbQnofE9VGM75eY_i7HPNn9Cag==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:36:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 22974
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig23-ivanti-patch-timestamp-datetimetab.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/ 15 KB
16 KB 61ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/fig23-ivanti-patch-timestamp-datetimetab.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3c34-6242c0cd96a40"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: l4n6zs9S43tvHz4pr-JRiSkUkv1ntrIUwB2c4xaHce_pXT3KHQdNTw==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:37:53 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15412
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig24-ivanti-comparison-code.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/ 93 KB
94 KB 60ms
59ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/fig24-ivanti-comparison-code.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1737c-6242c0f0dfd80"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: YJc6I-jS4_zCW3A2wAcdQzT6EDPQZFxecsU2Jzs81ozc7k3Thx8lzg==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:38:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95100
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig25-ivanti-exploitation-testing.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/ 129 KB
130 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/fig25-ivanti-exploitation-testing.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "20339-6242c12183040"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: yGnfpeCHx2T5a4kd0VTV-vNXuLDe5fI7DEFyYslHh9FSwmhwW-Kl7A==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:39:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 131897
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig26-ivanti-testing-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/ 107 KB
108 KB 64ms
64ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/fig26-ivanti-testing-command-injection.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1ab81-6242c19d7d4c0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: cqGgNxuDlyTyFLoRakr61SdNGTM4jam4kv7WR3zh5hGLt5og01FSJA==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:41:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 109441
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-sample-malicious-post.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ 65 KB
66 KB 64ms
63ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ivanti-sample-malicious-post.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10408-6242c1c867a00"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: jUX_AoP2k-uGxQkhkelL5qLz95OdhOTdXuQHD5jwWcaZ9NRTLjN0VQ==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:42:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66568
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-sqls-remote-code-execution.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ 89 KB
90 KB 65ms
64ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ivanti-sqls-remote-code-execution.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "16350-6242c1f25dd00"
Age: 223432
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: JXqUZhmXPVPodp0el97MM7GNE-Z2IDtyOsaWUY5ADFwzIfeWb9z2RQ==
Date: Fri, 11 Oct 2024 17:52:09 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 90960
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table01-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/ 50 KB
51 KB 62ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/table01-ivanti-threat-actor-commands.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "c75d-6242c27abdec0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DAWtN13rV-dCBx1aolMVm0ee-4VwTx7kZtzmhR7oKFHZgkqM1pLLpQ==
Date: Fri, 11 Oct 2024 17:52:10 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:45:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 51037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-powershell-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ 77 KB
79 KB 63ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ivanti-powershell-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "134e8-6242c2a0e38c0"
Age: 223433
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: yJSXUT4G6iTJVI_6pP1ryatK193EwTwjTPqN29vJrcXko-dyda_Zog==
Date: Fri, 11 Oct 2024 17:52:10 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:03 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 79080
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig27-ivanti-content-1log.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/ 51 KB
53 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/fig27-ivanti-content-1log.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ccf0-6242c2c520e40"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: v8bTFwD6pRx8mRQNGQTxx-A1vDoxOZxJcm5ONshkAYy2Od1KA-X17Q==
Date: Fri, 11 Oct 2024 17:52:10 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:41 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 52464
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table02a-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/ 1003 KB
1004 KB 63ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/table02a-ivanti-threat-actor-commands.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "faaf9-6243549114880"
Age: 223432
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: R8BHVCP-zYKwlrrIfFr04razeCKarP6tNxftCkEjIYZ9rnp_DwxSng==
Date: Fri, 11 Oct 2024 17:52:10 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:38:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1026809
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table03-ivanti-web-shells.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/ 80 KB
82 KB 65ms
65ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/table03-ivanti-web-shells.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1416e-6242c50802400"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: UfyAASd2GQRN8aqVzFL8127Gx7EYKdd7octd-RqXOJGXMuhi5wLXjw==
Date: Fri, 11 Oct 2024 17:52:11 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:56:48 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 82286
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig28-ivanti-brute-force-tooling.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/ 37 KB
38 KB 63ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/fig28-ivanti-brute-force-tooling.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "9326-6242c529632c0"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: v4ZK4Xz_MKdte4z8MmQ55FdFHv3ldAzS20vJncKhY8A9FHJIQUj8ig==
Date: Fri, 11 Oct 2024 17:52:11 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37670
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig29-ivanti-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/ 23 KB
24 KB 63ms
63ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/fig29-ivanti-content.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5c88-6242c546f3880"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 4vc1nateAa6R8Im6rZ2FjwDP_yAAmcNuGsQKBDH0RR1KNSzCLlMwWA==
Date: Fri, 11 Oct 2024 17:52:11 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:54 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23688
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-csa-appliance.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ 41 KB
42 KB 60ms
59ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ivanti-csa-appliance.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "a328-6242c56854740"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7i0XFM6boLo5uhGPKJQme432kxuYGZZ3LwOuMezV40e7U5G0aSCpWg==
Date: Fri, 11 Oct 2024 17:52:11 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-php-variables.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ 35 KB
37 KB 67ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ivanti-php-variables.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "8df4-6242c584f0ac0"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 26hOZN5_ucl5nKvcSZLPcFg1Ya0zrdxh4RhFjgzN8K5n8cQ1ez_o_Q==
Date: Fri, 11 Oct 2024 17:52:11 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 36340
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-linux-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ 65 KB
66 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ivanti-linux-kernel.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10317-6242c5a745bc0"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: c86NBTOeHvWHGQpFVU8-yzbnQ5IiBhA7FeDYKwC9_m8gnSHd7rN7uA==
Date: Fri, 11 Oct 2024 17:52:11 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:59:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66327
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig30a-ivanti-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/ 171 KB
172 KB 61ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/fig30a-ivanti-base64.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2ac3e-6242c5e266740"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: uCCS-YGEQkHBhKHXSUgBn_essatJGZTmZmS3Bj00eElGprYdUTctLQ==
Date: Fri, 11 Oct 2024 17:52:12 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:00:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 175166
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig30b-malicious-tar-file-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/ 14 KB
16 KB 61ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/fig30b-malicious-tar-file-content.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "38ce-6242c600eaf40"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VDjfQ4DSwFmcsMKF3U-0p9mR1slz0PpaV-2OW1R352T6iGvRXywK4g==
Date: Fri, 11 Oct 2024 17:52:12 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 14542
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig31-ivanti-rootkit-files.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/ 20 KB
21 KB 62ms
62ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/fig31-ivanti-rootkit-files.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4f8f-6242c62157bc0"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 3JOOl5xm1vs1lqAGNORmn7ZVRlonaE_DIQtocj7bYHklBRVZb0laUQ==
Date: Fri, 11 Oct 2024 17:52:12 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 20367
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-script-start-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ 79 KB
80 KB 61ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ivanti-script-start-param.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "13afb-6242c64c42100"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: LLO5_3OiqDAdqX_Pv5cGejhBzeqQ_OhH_P4Q8_A6dGr-4fyZa1BzPg==
Date: Fri, 11 Oct 2024 17:52:12 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:02:28 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80635
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-script-second-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ 12 KB
14 KB 60ms
60ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ivanti-script-second-param.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "31e8-6242c66caed80"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: PA2E1bG1ux-J69P7dvvQgl8W9OQZNBI5zWnC-QIBjEpoFz5_GyYODQ==
Date: Fri, 11 Oct 2024 17:52:12 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:03:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 12776
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-code-snippet-path-exists.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ 31 KB
32 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ivanti-code-snippet-path-exists.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ad4-6242c6bbd6840"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: d5k037IIFWjnZ_TrAU0IGgCBIjdUucxXyrjuDIPPI0qiYb8NDNh5OA==
Date: Fri, 11 Oct 2024 17:52:12 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:04:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31444
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig32-ivanti-installation-malicious-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/ 23 KB
24 KB 64ms
64ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/fig32-ivanti-installation-malicious-kernel.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5bd6-6242c6ed6dd40"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: UaW8cDNDzhZT3GG4vnnzYRN4c0XkjbNeNe9ufDfgQpDMb4PWsanxQw==
Date: Fri, 11 Oct 2024 17:52:12 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23510
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig33-ivanti-establishing-rootkit.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/ 67 KB
69 KB 62ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/fig33-ivanti-establishing-rootkit.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10d87-6242c70bf2540"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: s2hRJZDdpkMGCGNnpFrvpsv5Lm9QUrwTKekSpQyc8MD1l3XArkNUNA==
Date: Fri, 11 Oct 2024 17:52:13 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 615fb4121a4d8bc094d80720dc4d32b2.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 68999
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig34-ivanti-rootkit-persistence.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/ 57 KB
58 KB 61ms
61ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/fig34-ivanti-rootkit-persistence.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e339-6242c7330c180"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: b7Tu84dMMK-WM6ZkfYEdK678kr5MHsS7ZdtvW2DEK5AxaCAY0ebIMw==
Date: Fri, 11 Oct 2024 17:52:13 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:06:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58169
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table04-ivanti-mitre-mapping.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/ 94 KB
96 KB 62ms
59ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/table04-ivanti-mitre-mapping.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "178fb-62435606eba80"
Age: 223434
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: yRq6lyTkcgeX8MBPz-yw0ppgC8DUzoZQai_C_PasSbUrWWqM1yBDlw==
Date: Fri, 11 Oct 2024 17:52:13 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:45:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96507
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 44ms
43ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 58650
x-content-type-options: nosniff
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 425c5af0-c01e-0055-1698-ee78fd000000
cf-ray: 8d25ec9c1f98a530-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/ 99 KB
24 KB 51ms
50ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: SDJFQYswktbx6w5cJzzMRQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2B6F9C71
age: 30743
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 15 Oct 2024 07:40:57 GMT
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:57:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 9f466969-301e-009d-1cc8-39cb39000000
cf-ray: 8d25ec9ccb55336d-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24004
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
3 KB 52ms
51ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 35069
x-content-type-options: nosniff
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: e7ba9f8a-a01e-0009-5512-247c50000000
cf-ray: 8d25ec9d2b6b336d-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 44ms
44ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 40224
x-content-type-options: nosniff
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 77f313b5-301e-0034-7eb4-210a4b000000
cf-ray: 8d25ec9d2b6c336d-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
122 KB 223ms
68ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 62ccea4549c1c360f561987e20bd929c475a5f596bc7731a224d99e0d253cfa0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "af0a8014ad3a875765ca4dd5d5ca9349:1728346478.684687"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 124284
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:38 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 367 B
915 B 197ms
63ms XHR
application/json 35.173.146.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1728891657887

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.173.146.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-146-122.compute-1.amazonaws.com

Software

Resource Hash

356fdd586e751109b05f1b9fe931be5e67dad421c507d8b309df252b9c0fafb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v065-09d862424.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: xvgLFbUvTvs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 310
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame 1079 0
0 185ms
58ms Document
text/html 35.173.146.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.173.146.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-146-122.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 14 Oct 2024 07:40:58 GMT
dcs: dcs-prod-va6-2-v065-0a0d2f944.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 10 Oct 2024 10:03:20 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: PZkw1oZmQ/k=

GET
H2

200

ibs:dpid=411&dpuuid=ZwzLCgAAAG22OQNw
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=69055857823743530071852983280508792246
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwzLCgAAAG22OQNw

42 B
716 B

62ms
61ms

Image
image/gif

35.173.146.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwzLCgAAAG22OQNw

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Server

35.173.146.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-146-122.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v065-0dc5d12d6.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: iAz/0sYJTjM=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwzLCgAAAG22OQNw
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Mon, 14 Oct 2024 07:40:58 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
839 B 227ms
75ms XHR
application/json 63.140.39.248
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=ef66e33f9f6647f68e2cc85eac9709e7&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.248 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-248.data.adobedc.net

Software

jag /

Resource Hash

4404fc30fd4d13c928a452eb527f304940c70f4726c7e4ee58f7cdc0dd0ca9f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 69b0d1a9-2c23-4140-a815-4eb0ce9eeb6b
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Mon, 14 Oct 2024 07:40:58 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 67ms
66ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 66ms
66ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 103ms
44ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 236731
cf-polished: origSize=6996
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: text/javascript
last-modified: Fri, 11 Oct 2024 13:55:17 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d25eca0ed4b2209-MIA
access-control-allow-origin: *
ce-version: 11.5.299
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 225ms
65ms Script
application/javascript 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111d7"
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 10:40:58 GMT
accept-ranges: bytes
content-length: 18830
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 222ms
65ms Script
application/x-javascript 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-192.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3ac2943bf8d9d7f8d3dfa505f1c382b028fa493ffb2e3e2145595815df4ee999

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "f41d7dee86b46fd9726c83903f0d6cbe:1728888767.088324"
Connection: keep-alive
Expires: Mon, 14 Oct 2024 08:00:58 GMT
Accept-Ranges: bytes
X-CC: US
Content-Length: 8746
X-RG: NA
Date: Mon, 14 Oct 2024 07:40:58 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 14 Oct 2024 06:18:14 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 187ms
61ms Script
application/javascript 34.86.70.109
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.70.109 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 109.70.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_5BzacfToVII-jhjUVB
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 161ms
57ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 072E220A10F74851B2AAD8CE9C99A4E7 Ref B: MIAEDGE2919 Ref C: 2024-10-14T07:40:58Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H2 200 RCac955f2e1e97429197e1e31aaec22e86-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1 KB
940 B 74ms
70ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCac955f2e1e97429197e1e31aaec22e86-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b0c24ca8333c5e792fdbb0d0a02529e99999ae19484c6e304c4cc8ce4535d485

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 683
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 9 KB
2 KB 69ms
66ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 450be4bf64305ebda12eebbbbdba85912e51497cbb52f921dab64a44310a16b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1844
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 358 B
483 B 71ms
68ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 608f95c0544308eaef8ee3554248e93e668f323fb954f584ddc12cd65947d251

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 227
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 703 B
683 B 70ms
68ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0d41c18875dbfc417ec3cdb20d698edd52b930504892fe1e3dd1c0f1ba9b42f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 426
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 365 KB
121 KB 229ms
90ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fe2df0ff2352bec1f81fff7ebc21b7a1e6e5795b008f89bcf685490a8357804d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 14 Oct 2024 07:40:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 122838
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 635 B
642 B 69ms
68ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 90a224ae782e3be06cc08cd0dea598ea22f91ee4635920cc77228326bb5409d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:40:58 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 77ms
43ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d4563ccb41566b8923320d610edf0aaf3ae71601dc3ee3e9b2e53de47bab913

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 236731
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/json
last-modified: Fri, 11 Oct 2024 13:55:17 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d25eca16aa75d10-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1806
ce-version: 11.5.299
server: cloudflare

GET
H3 200 2780555e46c3031ae97407e9c52b4705.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 105 KB
36 KB 43ms
43ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 236747
cf-ray: 8d25eca1bd842209-MIA
cf-polished: origSize=107371
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: text/javascript
last-modified: Tue, 08 Oct 2024 19:20:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 370 B
424 B 57ms
57ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7f47f02c93d5de5de03db0ebffa39fe1060767437b086996e295c9818a05b2f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1DE386A8FECB4129AD7D8DD6D32431FD Ref B: MIAEDGE2919 Ref C: 2024-10-14T07:40:58Z
x-cache: CONFIG_NOCACHE
date: Mon, 14 Oct 2024 07:40:57 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
105 KB 200ms
200ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1d3639dfba925efec9bc981060fbc61a5c8b57f54c333b7aa95b8c46b87eb24b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 14 Oct 2024 07:40:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 107267
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 217ms
65ms Fetch
image/gif 64.202.112.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=0902545662141556&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.63 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: image/gif;
x-traceid: 4c0bd6597ba02887fbb9c6948838d82a

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 219ms
67ms Script
application/javascript 64.202.112.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.63 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript
x-traceid: 5373733101fd1c39ea267bd1b7a4564e

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 200ms
63ms Script
text/html 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-51-57-192.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1728851319850
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Mon, 14 Oct 2024 07:41:58 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 22
X-RG: NA
Date: Mon, 14 Oct 2024 07:40:58 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: c270df78069151e2c57032595c4f8bae

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 195ms
65ms Fetch
text/html 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-192.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Mon, 14 Oct 2024 08:00:58 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 26
X-RG: NA
Date: Mon, 14 Oct 2024 07:40:58 GMT
Content-Type: text/html

GET
H2 204 0
bat.bing.com/action/ 0
358 B 56ms
56ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=25c944ca-c6dd-40c6-8f41-0b816806f130&sid=a72569a089ff11ef9335f3a1e6f796d8&vid=a725914089ff11efbf5e0d50fb1e2073&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,zero-day%20vulnerability&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&r=&lt=788&pt=1728891656667,,,,,0,1,36,36,428,93,429,492,551,498,766,766,788,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=379020

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3C9820EA64454189A2686124584C8D17 Ref B: MIAEDGE2919 Ref C: 2024-10-14T07:40:58Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 14 Oct 2024 07:40:57 GMT

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
279 B 41ms
41ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 236731
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/json
last-modified: Fri, 11 Oct 2024 13:55:18 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d25eca28b585d10-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.299
server: cloudflare

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 75ms
65ms XHR
text/html 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-88-71.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
309 B 231ms
67ms XHR
text/html 2600:141b:1c00:2e::17d1:48d1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:2e::17d1:48d1 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 55942e39d9e64b74d3bb291146a1115692ee6d7abe453e982a88b291e65e825d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:550:1d05:1::12
expires: Mon, 14 Oct 2024 07:40:58 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1728891658768_399550021_286922095_14_587_64_68_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 19
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 87ms
76ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A40%3A58%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:40:58 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 83ms
73ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2014%20Oct%202024%2007%3A40%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2014%20Oct%202024%2007%3A40%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2014%20Oct%202024%2007%3A40%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2014%20Oct%202024%2007%3A40%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2014%20Oct%202024%2007%3A40%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:40:58 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 204 clock
tracking.crazyegg.com/ Frame 0
0 230ms
80ms Preflight 3.128.169.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1728891658687&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.169.50 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-128-169-50.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Mon, 14 Oct 2024 07:40:58 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

POST
H2 200 clock Show response
tracking.crazyegg.com/ 39 B
145 B 89ms
88ms XHR
text/plain 3.128.169.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1728891658687&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.169.50 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-128-169-50.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 01f00c0b455f5ebd696d7d8bc51353edcb8a966f20eb48d47ea82dc25daedbe6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 39
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: text/plain
server: awselb/2.0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 256 KB
90 KB 85ms
83ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b563ed473907fc2b2b200f195cec2672be1afc75de48ca5b87aa6079c884f3de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 14 Oct 2024 07:40:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 14 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92500
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 89ms
88ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d6dcf3c83210f0829b09bbcd22fbaa7b3427c2313f36567aba12390f96edb983

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 14 Oct 2024 07:40:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 14 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81603
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 237 KB
85 KB 125ms
125ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7383a414cc9f6ee281f5ccabdee78ab072883d0ce603a8f6a3efa56d1429ee8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 14 Oct 2024 07:40:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 14 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87082
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 102ms
102ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

54305fb0b04f504e85e6318bc8671487cb4248b38cd411530bbeff8d8a30ca90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 14 Oct 2024 07:40:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 14 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90183
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 642 B
584 B 176ms
88ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 12860f9b5e19a7620896525dfee0894ebd37e33aacbbeb6c9c97ec973fe7d7b7

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.fortinet.com
content-length: 324
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 157ms
59ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Mon, 14 Oct 2024 07:40:58 GMT
timing-allow-origin: https://6sense.com
x-6si-region

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 211ms
75ms Fetch
text/plain 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je4a90v9191763579za200&_p=1728891658342&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101686685&cid=903817064.1728891659&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1728891658&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2200
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 47 KB
17 KB 257ms
87ms Script
application/javascript 2a02:6ea0:c454::1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: 96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1b1-bb6c"
cdn-fileserver: 749
date: Mon, 14 Oct 2024 07:40:59 GMT
cdn-storageserver: NY-346
last-modified: Thu, 10 Oct 2024 14:16:17 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/12/2024 23:29:28
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: e46ed0e383bf1706063c961eddee3807
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-triggerededgerule: a507b864-43b8-4277-b8aa-201eb3fa4d9d, 312b8174-53bc-4228-b69f-a97dfd5b1241, 312b8174-53bc-4228-b69f-a97dfd5b1241
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: US

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 74ms
74ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=ipv6&q=%7B%22address%22%3A%222001%3A550%3A1d05%3A1%3A%3A12%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:40:58 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:40:58 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=390758419.1728891659;ps=1;pcor=441157811;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13...
td.doubleclick.net/td/fls/rul/ Frame 6D48 0
0 220ms
85ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=390758419.1728891659;ps=1;pcor=441157811;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Oct 2024 07:40:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=390758419.1728891659;ps=1;pcor=441157811;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1...
ad.doubleclick.net/ 42 B
65 B 260ms
180ms Image
image/gif 142.251.40.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=390758419.1728891659;ps=1;pcor=441157811;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.102 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=390758419.1728891659;ps=1;pcor=441157811;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb91230...
ad.doubleclick.net/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 43 B
61 B 198ms
78ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1728891659016&cv=11&fst=1728891659016&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame 5545 0
0 158ms
87ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1728891659016&cv=11&fst=1728891659016&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Oct 2024 07:40:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 5 KB
2 KB 143ms
83ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1728891659075&cv=11&fst=1728891659075&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

95821af532710ce1b72f0cd8a446d00e30e43aad802c77a0918e0da43d631ef0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2415
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 4C13 0
0 100ms
88ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1728891659075&cv=11&fst=1728891659075&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Oct 2024 07:40:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 5 KB
2 KB 90ms
81ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1728891659127&cv=11&fst=1728891659127&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

9b7d20ca2f95b29c301c1fa68ad413e59d2a257d129937cc1da942f2f55ffdb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2421
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame FF58 0
0 85ms
85ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1728891659127&cv=11&fst=1728891659127&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Oct 2024 07:40:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 225ms
85ms Preflight
application/json 18.173.219.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.219.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-219-118.jfk52.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Mon, 14 Oct 2024 07:40:59 GMT
via: 1.1 619f2eec0ea05d2ce0279df117eb9a0c.cloudfront.net (CloudFront)
x-amz-apigw-id: foSp0GZRIAMEXoA=
x-amz-cf-id: fARmjiBjkhs6tXgRXBAEhy7kuXJrHqqMtGR30IHc1JmhTia5BCYPmQ==
x-amz-cf-pop: JFK52-P1
x-amzn-requestid: abc17319-045c-4413-8ee9-d4e667f45353
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
518 B 158ms
156ms XHR
application/json 18.173.219.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.219.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-219-118.jfk52.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.fortinet.com/

Response headers

x-amz-apigw-id: foSp1GHtIAMEHcg=
x-amzn-trace-id: Root=1-670ccb0b-232ba6fd09cb88cf4ab92f75;Parent=743dcb175edd8342;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 4f022cff-e344-4b8c-bf0d-55b5f0487804
via: 1.1 619f2eec0ea05d2ce0279df117eb9a0c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: VdghBRcnB2uuHfJ5KNV8Ibr2TwM-vgerdoYcVbTSttnuDSghgMbgbg==
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P1
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 79ms
79ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A2162.300000190735%2C%22duration%22%3A334.79999923706055%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A2162.300000190735%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A2497.0999994277954%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=&d=1&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:40:59 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 264ms
112ms Stylesheet
text/css 2a02:6ea0:c454::1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1c2-2644"
cdn-fileserver: 749
date: Mon, 14 Oct 2024 07:40:59 GMT
cdn-storageserver: NY-427
last-modified: Thu, 10 Oct 2024 14:16:34 GMT
content-type: text/css
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/12/2024 23:29:28
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 475500aad7c2cb3b346774df4a7e2e86
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: US

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
593 B 199ms
120ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Mon, 14 Oct 2024 07:42:57 GMT
x-cache: Error from cloudfront
x-amz-cf-id: AvkPoh7rQQz83ZS5XSFXX_xisl4W_uA0EOpAgDPmDQdRwPHTa2Y5uA==
date: Mon, 14 Oct 2024 07:40:59 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 35fc94560da4941563352a51b45ac862.cloudfront.net (CloudFront)
cf-ray: 8d25eca68a505c7c-MIA
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: MIA3-P7
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 126ms
46ms Script
text/javascript 2606:4700::6812:1347
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 70017
via: 1.1 google
cf-ray: 8d25eca68ea27487-MIA
expires: Mon, 14 Oct 2024 08:00:59 GMT
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 349ms
114ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Mon, 14 Oct 2024 07:40:59 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 289ms
145ms Script
text/javascript 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20241014T074059Z-16cd4984cd6mt4j7wvwcatuvec00000004wg00000000dkwp

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
712 B 216ms
69ms Script
text/javascript 216.200.232.249
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.200.232.249 Frederick, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master ord ord-pixel-x50 config_version:"2536" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Mon, 14 Oct 2024 07:40:59 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master ord ord-pixel-x50 config_version:"2536"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 323 KB
107 KB 88ms
88ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

361330b11a948b280cafcb7e36c6653e663491d0c528db10700b0d26c6782269

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 14 Oct 2024 07:40:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109492
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK footer-links.json Show response
www.fortinet.com/content/dam/fortinet-blog/ 310 KB
36 KB 63ms
62ms XHR
application/json 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/footer-links.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "4d8dc-61d89b0f78340-gzip"
Age: 7564551
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: J_C58f2F5qN4XvSHIjaqZLPULfFDfrPIWznESLx75o5T11yII5FvlQ==
Date: Mon, 14 Oct 2024 00:11:34 GMT
Content-Type: application/json
Vary: Accept-Encoding
Last-Modified: Thu, 18 Jul 2024 18:24:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35378
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 201ms
79ms Image
image/gif 142.251.40.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1728891659127&cv=11&fst=1728889200000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnf7V6hBF7CIdUk8IZ7nzixWmCuAlUzkA&random=493907911&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.228 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 199ms
79ms Image
image/gif 142.251.40.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1728891659075&cv=11&fst=1728889200000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=390758419.1728891659&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfWtrJoCXa3zGbZuuw_JszCR4PPVO6Vw&random=951706797&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.228 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 s23339175494035
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
373 B 201ms
62ms Image
image/gif 63.140.39.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s23339175494035?AQB=1&ndh=1&pf=1&t=13%2F9%2F2024%2021%3A40%3A59%200%20600&sdid=20977D8FD0A19510-280370E071A1309C&mid=68690314511376327431815298513879485502&aamlh=7&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&c7=Entire%20Site&c8=New&v25=68690314511376327431815298513879485502&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&v106=Miami&v107=Florida&v108=United%20States&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.15 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-15.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
etag: 3712766567328710656-4618466798455386649
x-content-type-options: nosniff
expires: Sun, 13 Oct 2024 07:40:59 GMT
access-control-allow-origin: *
p3p: CP="This is not a P3P policy"
content-length: 43
date: Mon, 14 Oct 2024 07:40:59 GMT
x-xss-protection: 1; mode=block
last-modified: Tue, 15 Oct 2024 07:40:59 GMT
vary: *
server: jag
content-type: image/gif;charset=utf-8

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
448 B 78ms
77ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1728891659329&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Mon, 14 Oct 2024 08:40:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AHmUCY11bvmNNMrhWnWbqy0W5YHSY63VyqIMK5cQmMAuU4AHhbhSt-gilVP7R6muuSSPgDZ5_VGiTfVSZg
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 146ms
66ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1728891659329&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 14 Oct 2024 07:40:59 GMT
expires: Mon, 14 Oct 2024 07:40:59 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AHmUCY0DfC9BU4mHvBejleJFjAHACWvJQZNY7wPQaxg8kUt4QliSfg4dSXtdqp9FeDb1KJ4KkKMQJiQVcQ

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 76ms
75ms Fetch
text/plain 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je4a90v893708426za200zb9123037237&_p=1728891658342&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101686685&cid=903817064.1728891659&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1728891659&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2791
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: text/plain
server: Golfe2

GET
H2 401 / Show response
pixels.argusplatform.com/wh/track/ 205 B
468 B 717ms
578ms XHR
application/json 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1728891659009542147&event_type=page_request&timestamp=1728891659&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20241014T074059Z-16cd4984cd6m8shw3zbky3npe400000006p000000000de4d

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
14 KB 103ms
32ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 20870
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-mia-kmia1760091-MIA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13749
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 117ms
116ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 346ms
112ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Mon, 14 Oct 2024 07:40:59 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

GET
BLOB 200
OK 85bec16b-28b9-4d01-aabe-40b126e4fdcb
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/85bec16b-28b9-4d01-aabe-40b126e4fdcb
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 75ms
74ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A40%3A59%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A40%3A58%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:40:59 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:40:59 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 114ms
114ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?visitorId=0ac9c017dfdd772893a32ead8dfce3c5_1728891659753&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Mon, 14 Oct 2024 07:40:59 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 354ms
116ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=0ac9c017dfdd772893a32ead8dfce3c5_1728891659753&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Mon, 14 Oct 2024 07:41:00 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 189 KB
68 KB 86ms
86ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f7e36db0ac9c67d63a232f58f7e6b9610b31c58f0ab9402e4dc500f8c41c05bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Mon, 14 Oct 2024 07:41:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 14 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 69294
x-xss-protection: 0
server: Google Tag Manager

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1728891659753
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1728891659753&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AAHCD07OGZYAABWr__X1lg

0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 77ms
76ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A40%3A59%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222007%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:41:00 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 401 / Show response
webtracker.argusplatform.com/wh/track/ 205 B
468 B 562ms
418ms XHR
application/json 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1728891659009542147&event_type=page_request&timestamp=1728891661&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20241014T074100Z-16cd4984cd6djbzb3ahc7ub9q000000006cg00000000sspn

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
1011 B 67ms
66ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 03a0fcddc62f902b243bb6ed855041f4fa937340fd81d86552f672f24d6497da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 754
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
756 B 67ms
67ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0d87642c368aa398fe4dd35af439768fb2c9167ba52f2b995eaa3d61598853a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
756 B 68ms
67ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5f7c381eca2f132069a8514789e46793cf6f5886b523ac91db7e33c41182248d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 499
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC8c594cd344f84ab89afc779d8f53fff4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1 KB
811 B 68ms
68ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC8c594cd344f84ab89afc779d8f53fff4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2e963b4b8f73348a8de67ca3f24258b1bfc6874339867af3119bd8751ad9db79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 554
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5915f5d7e33546579cd5fd510349ed90-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 722 B
715 B 68ms
68ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC5915f5d7e33546579cd5fd510349ed90-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 55efcd9c7c8dc07e65a641a23760facd1b95fa530876ac2d2766e3247764ad3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 458
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 661 B
648 B 69ms
68ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 661e67a6ed119b9a5bd08892caf68b0e794f68207156cd50f703d320ee6155ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 368 B
491 B 71ms
71ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c153cd2dff5ec3af05397a2fe0f7dc1eb7544b5858521dca8bf1c20e439d70d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 234
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 754 B
704 B 71ms
71ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f46a9869eb1b18c3d0274a6ab46008bb2cfaa73cc3fbb25df8e2d6085ad706da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
970 B 70ms
70ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1bfc3fec636bdfc92ca324c43dc9382d5f1567b0cb29f806202c2ee530173b7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 713
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1021 B
856 B 70ms
70ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8c0aa54f351ccf9f614ac7519cec00ae1f40db7bbea8c7dd2fb51538a8d9b272

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 600
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
757 B 133ms
133ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4e9aa67ca1f1ffe2c11e722079a58f1be803c9378468d6c019be53b1ffd26c6b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 501
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 388 B
498 B 134ms
134ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9636ce7f4b06bd40058b0417691448095e6490a3b518fbdeac3e104023fd9b92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 664 B
656 B 134ms
134ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c50c3a763973b8bc75e126c3f104f84a728f8febf50faa7e37685e86fa1e2c1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 400
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
981 B 133ms
133ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a23b68a0964626bb4062bf726dd4ab52d438dcfb88991402b224146d1087d1a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 724
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 966 B
808 B 133ms
133ms Script
application/x-javascript 2600:141b:1c00:209f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209f::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 18e04370c6f2bee61d32771663e6b0408e1627bb89a3894457941fa19ad83000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Mon, 14 Oct 2024 08:41:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 551
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
760 B 79ms
55ms Script
application/javascript 34.86.70.109
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.70.109 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 109.70.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: 56138472b46ef4a945c8a494b3dd9075d633e5d5216aee94ded521346585eb0a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 63ms
62ms Other
image/vnd.microsoft.icon 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 901708
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NqJaSh9CPSTARoevQqExdlW3TJIW4MHycriQ2SLOEd9VTWYwifIMIg==
Date: Fri, 04 Oct 2024 00:09:26 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 aadad266be53162e069ead52871dac74.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 267ms
62ms Script
application/javascript 34.238.149.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=92919375704191140term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.238.149.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-238-149-65.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: d3850813296810130e6341b36b856c6a32e7273ab57f12db7b47a90a61ee72f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 3
expires: Thu, 01 Jan 1970 00:00:00 GMT
be: spx-prod
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 204ms
59ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip"
accept-ranges: bytes
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Mon, 14 Oct 2024 07:41:00 GMT
x-tw-cdn: FT
last-modified: Tue, 26 Mar 2024 20:58:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000022-IAD
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 217ms
67ms Script
application/javascript 2600:141b:1c00:6::17df:d105
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:6::17df:d105 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=24176
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Mon, 14 Oct 2024 07:41:00 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 190ms
59ms Script
text/javascript 44.214.225.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.214.225.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-214-225-221.compute-1.amazonaws.com
Software: /
Resource Hash: edbed558f7bf5f6f28a8eb47251014ecc722ea300f8b11b31d841072ea5e6a88

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: text/javascript

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

67ms
67ms

Image
image/gif

68.67.160.26
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

68.67.160.26 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.75; 38.132.118.75; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: bf321d97-3e25-448d-bf92-83e39ed4252b
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 38.132.118.75; 38.132.118.75; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 90a8b32d-601a-4b0f-a34a-2b89ef9188a2
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 14 Oct 2024 07:41:00 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

67ms
66ms

Image
image/gif

68.67.178.10
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

68.67.178.10 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.75; 38.132.118.75; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: e27383bf-7c38-49a5-a455-f8f0fc9f010a
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.75; 38.132.118.75; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 4e30d76e-d3b8-4fb9-bada-88b5b726c349
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 14 Oct 2024 07:41:00 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
442 B 223ms
64ms Script
application/octet-stream 2600:9000:2512:c600:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2512:c600:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 51621
via: 1.1 909ec3586e2eba60d35c2f3468905558.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: CwTr_SRsMzxw2g2ovG2heDN9yXkfo4sxOKL5izeq4femRwgjv0VI6g==
date: Sun, 13 Oct 2024 17:20:40 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P7
x-amz-server-side-encryption: AES256

GET
H2

200

setuid
sync.inmobi.com/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=22F3E13362E54C0097F4EF24E93C1D50
https://sync.inmobi.com/setuid?bidderID=82&dspUserId=1b9ed4174a

2 B
282 B

207ms
59ms

Image
image/avif

20.33.59.55
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=82&dspUserId=1b9ed4174a
Protocol: H2
Server: 20.33.59.55 Washington, United States, ASN8069 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: *
content-length: 2
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/avif;charset=UTF-8
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy
access-control-allow-headers: Content-Type, X-Requested-With

Redirect headers

cache-control: no-cache, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=82&dspUserId=1b9ed4174a
via: 1.1 e9fae68a5077ddad48f891e10e9046ae.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 1JwZ01dBeu8IxlO3Qlozd3XRkBoFC1lG96qUldyjm2zcHsopX0ZQAw==
date: Mon, 14 Oct 2024 07:41:01 GMT
x-amz-cf-pop: JFK52-P7
server: CloudFront

GET
H2

204

22F3E13362E54C0097F4EF24E93C1D50
sync.1rx.io/usersync/simplifi/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/22F3E13362E54C0097F4EF24E93C1D50

0
99 B

184ms
56ms

Image
text/plain

69.194.240.13
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1rx.io/usersync/simplifi/22F3E13362E54C0097F4EF24E93C1D50
Protocol: H2
Server: 69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
date: Mon, 14 Oct 2024 07:41:01 GMT
pragma: no-cache

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.1rx.io/usersync/simplifi/22F3E13362E54C0097F4EF24E93C1D50
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:00 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=22F3E13362E54C0097F4EF24E93C1D50&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=22F3E13362E54C0097F4EF24E93C1D50&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
474 B

60ms
59ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=22F3E13362E54C0097F4EF24E93C1D50&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=22F3E13362E54C0097F4EF24E93C1D50&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Mon, 14 Oct 2024 07:41:01 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=22F3E13362E54C0097F4EF24E93C1D50

43 B
175 B

199ms
58ms

Image
image/gif

2600:1f18:612b:4200:b056:b715:fbe2:c105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=22F3E13362E54C0097F4EF24E93C1D50
Protocol: H2
Server: 2600:1f18:612b:4200:b056:b715:fbe2:c105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=22F3E13362E54C0097F4EF24E93C1D50
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=22F3E13362E54C0097F4EF24E93C1D50
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=22F3E13362E54C0097F4EF24E93C1D50

95 B
427 B

51ms
49ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=22F3E13362E54C0097F4EF24E93C1D50

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=22F3E13362E54C0097F4EF24E93C1D50
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Mon, 14 Oct 2024 07:41:01 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=22F3E13362E54C0097F4EF24E93C1D50
https://d.agkn.com/pixel/10751/?che=1728891661241&ip=38.132.118.75&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214710605035006929096
https://um.simpli.fi/aa_px?sk=214710605035006929096
https://um.simpli.fi/empty.gif

43 B
361 B

56ms
56ms

Image
image/gif

35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=22F3E13362E54C0097F4EF24E93C1D50
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=22F3E13362E54C0097F4EF24E93C1D50&ckls=true&ci=xRJxG2LliC&nc=false&trid=-1509788642

43 B
1 KB

76ms
75ms

Image
image/gif

2600:9000:2840:2a00:1b:6b7d:2300:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=22F3E13362E54C0097F4EF24E93C1D50&ckls=true&ci=xRJxG2LliC&nc=false&trid=-1509788642
Protocol: H2
Server: 2600:9000:2840:2a00:1b:6b7d:2300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 6a75aefffb503ce28b1881b80e9ba240.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: eq2hMer94F3XPHVYrzPcptkuXHUey27BM8dFUhgLfIL_IduzhPBi3w==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=22F3E13362E54C0097F4EF24E93C1D50&ckls=true&ci=xRJxG2LliC&nc=false&trid=-1509788642
pragma: no-cache
via: 1.1 6a75aefffb503ce28b1881b80e9ba240.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: mOfWj2b6wdFGaDaucQJg7XoSOZPxP6jcKrn1LGvOQ_UNqTRk0iRWsw==

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://um.simpli.fi/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:22F3E13362E54C0097F4EF24E93C1D50

42 B
550 B

196ms
56ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:22F3E13362E54C0097F4EF24E93C1D50
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:22F3E13362E54C0097F4EF24E93C1D50
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200

user-registering
ads.stickyadstv.com/
Redirect Chain

https://um.simpli.fi/freewheel
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=22F3E13362E54C0097F4EF24E93C1D50

43 B
653 B

327ms
68ms

Image
image/gif

63.251.28.211
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=22F3E13362E54C0097F4EF24E93C1D50
Protocol: HTTP/1.1
Server: 63.251.28.211 Secaucus, United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
x-sticky-vk: 1728891661346034-1217
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Date: Mon, 14 Oct 2024 07:41:01 GMT
Content-Type: image/gif
Server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=22F3E13362E54C0097F4EF24E93C1D50
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

engine
pbid.pro-market.net/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=22F3E13362E54C0097F4EF24E93C1D50;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=22F3E13362E54C0097F4EF24E93C1D50;mimetype=img;sr
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=MzkzODg2MzU5NTg2Njk2Njg4OA==
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEP2g2OoX1eMKWcPHTfSX0-s&google_cver=1

43 B
387 B

89ms
80ms

Image
image/gif

2600:1901:0:8eee::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEP2g2OoX1eMKWcPHTfSX0-s&google_cver=1
Protocol: H2
Server: 2600:1901:0:8eee:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
anserver: gapp1
expires: Mon, 1 Jan 1990 0:0:0 GMT
access-control-allow-origin: *
alt-svc: clear
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
server: Apache-Coyote/1.1

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEP2g2OoX1eMKWcPHTfSX0-s&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 315
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=22F3E13362E54C0097F4EF24E93C1D50&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=22F3E13362E54C0097F4EF24E93C1D50&j=0&xl8blockcheck=1

0
767 B

60ms
58ms

Image
text/plain

50.16.197.56
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=22F3E13362E54C0097F4EF24E93C1D50&j=0&xl8blockcheck=1
Protocol: H2
Server: 50.16.197.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-197-56.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Mon, 14 Oct 2024 07:41:01 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=22F3E13362E54C0097F4EF24E93C1D50&j=0&xl8blockcheck=1
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55964/
Redirect Chain

https://um.simpli.fi/yahoo
https://ups.analytics.yahoo.com/ups/55964/sync?uid=22F3E13362E54C0097F4EF24E93C1D50
https://ups.analytics.yahoo.com/ups/55964/sync?uid=22F3E13362E54C0097F4EF24E93C1D50&verify=true

0
130 B

59ms
58ms

Image
text/html

3.225.218.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55964/sync?uid=22F3E13362E54C0097F4EF24E93C1D50&verify=true

Protocol

Server

3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-218-10.compute-1.amazonaws.com

Software

ATS/9.1.10.137 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 14 Oct 2024 07:41:01 GMT
age: 0
content-type: text/html
server: ATS/9.1.10.137

Redirect headers

strict-transport-security: max-age=31536000
location: https://ups.analytics.yahoo.com/ups/55964/sync?uid=22F3E13362E54C0097F4EF24E93C1D50&verify=true
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
content-length: 0
date: Mon, 14 Oct 2024 07:41:01 GMT
age: 0
server: ATS/9.1.10.137

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=22F3E13362E54C0097F4EF24E93C1D50

0
421 B

255ms
71ms

Image
text/plain

52.70.179.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=22F3E13362E54C0097F4EF24E93C1D50
Protocol: HTTP/1.1
Server: 52.70.179.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-179-249.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Mon, 14 Oct 2024 07:41:00 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=22F3E13362E54C0097F4EF24E93C1D50
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

500
Internal Server Error

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=22F3E13362E54C0097F4EF24E93C1D50

27 B
27 B

225ms
69ms

Image
text/html

23.46.225.71
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=22F3E13362E54C0097F4EF24E93C1D50
Protocol: HTTP/1.1
Server: 23.46.225.71 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-46-225-71.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Mon, 14 Oct 2024 07:41:01 GMT
Content-Length: 27
Date: Mon, 14 Oct 2024 07:41:01 GMT
AK-GRN: 0.ab02c417.1728891661.723e622
Content-Type: text/html

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://stags.bluekai.com/site/29931?id=22F3E13362E54C0097F4EF24E93C1D50
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=22F3E13362E54C0097F4EF24E93C1D50
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=22F3E13362E54C0097F4EF24E93C1D50
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=22F3E13362E54C0097F4EF24E93C1D50

49 B
545 B

68ms
67ms

Image
image/gif

54.159.12.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=22F3E13362E54C0097F4EF24E93C1D50
Protocol: H2
Server: 54.159.12.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-12-227.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
x-server: 10.40.61.76
server: Jetty(9.4.38.v20210224)

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=22F3E13362E54C0097F4EF24E93C1D50
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Mon, 14 Oct 2024 07:41:01 GMT
x-server: 10.40.63.244
server: Jetty(9.4.38.v20210224)

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=22F3E13362E54C0097F4EF24E93C1D50
https://ce.lijit.com/merge?pid=2&3pid=22F3E13362E54C0097F4EF24E93C1D50&dnr=1

43 B
511 B

82ms
81ms

Image
image/gif

34.204.30.191
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=22F3E13362E54C0097F4EF24E93C1D50&dnr=1
Protocol: H2
Server: 34.204.30.191 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-204-30-191.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=22F3E13362E54C0097F4EF24E93C1D50&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 14 Oct 2024 07:41:01 GMT
vary: Accept-Encoding

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=22F3E13362E54C0097F4EF24E93C1D50
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogMjJGM0UxMzM2MkU1NEMwMDk3RjRFRjI0RTkzQzFENTAQABoNCI2Ws7gGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=9596a6e19ad87fee42fac89cba729f46d09b89da4c947fc432adc493b93778c9791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=9596a6e19ad87fee42fac89cba729f46d09b89da4c947fc432adc493b93778c9791426b5417dce21&rand=01622507

0
140 B

86ms
86ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=9596a6e19ad87fee42fac89cba729f46d09b89da4c947fc432adc493b93778c9791426b5417dce21&rand=01622507
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 246161A88C014EA8AA08479A11E8B11D Ref B: MIAEDGE1911 Ref C: 2024-10-14T07:41:01Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYkavVW6Nrc/gtNA8KwyA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 14 Oct 2024 07:41:00 GMT

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=9596a6e19ad87fee42fac89cba729f46d09b89da4c947fc432adc493b93778c9791426b5417dce21&rand=01622507
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Mon, 14 Oct 2024 07:41:01 GMT

GET
H3

200

/
www.google.com/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1728891660782&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1476937846&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLH...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1476937846&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHD...

42 B
64 B

80ms
80ms

Image
image/gif

142.251.40.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1026675585/?random=1476937846&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI55PDqq-NiQMV6htoCB0GKg2LMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfwsDyEt-0GKCaOTugcerKOQSBeGuqp4-KgYqAGJKQTe2l5ggQ&random=3462566639

Protocol

Server

142.251.40.228 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/1026675585/?random=1476937846&cv=7&fst=1728891660782&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQI&pscrd=IhMI55PDqq-NiQMV6htoCB0GKg2LMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfwsDyEt-0GKCaOTugcerKOQSBeGuqp4-KgYqAGJKQTe2l5ggQ&random=3462566639
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 111ms
108ms Image
text/plain 35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Mon, 14 Oct 2024 07:41:01 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=22F3E13362E54C0097F4EF24E93C1D50

43 B
1 KB

110ms
106ms

Image
image/gif

68.67.178.10
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=22F3E13362E54C0097F4EF24E93C1D50

Protocol

Server

68.67.178.10 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 38.132.118.75; 38.132.118.75; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: a3ff014d-68e4-4b8b-a34c-9b6f8a119510
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=22F3E13362E54C0097F4EF24E93C1D50
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=22F3E13362E54C0097F4EF24E93C1D50&expires=365

42 B
1 KB

201ms
59ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=22F3E13362E54C0097F4EF24E93C1D50&expires=365
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6243e6d91f620df69691e6242509309c
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=22F3E13362E54C0097F4EF24E93C1D50&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
content-length: 142
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=22F3E13362E54C0097F4EF24E93C1D50
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=22F3E13362E54C0097F4EF24E93C1D50

43 B
171 B

48ms
47ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=22F3E13362E54C0097F4EF24E93C1D50
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=22F3E13362E54C0097F4EF24E93C1D50
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 0
date: Mon, 14 Oct 2024 07:41:00 GMT
server: OXGW/0.0.0

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEOmSAtrsDOH184eyr_m8fX4&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=22F3E13362E54C0097F4EF24E93C1D50
https://um.simpli.fi/g_match?id=

0
320 B

56ms
54ms

Image
text/plain

35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Sun, 13 Oct 2024 07:41:01 GMT
access-control-allow-origin: *
date: Mon, 14 Oct 2024 07:41:01 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 229
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 59ms
57ms Stylesheet
text/css 44.214.225.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.214.225.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-214-225-221.compute-1.amazonaws.com
Software: /
Resource Hash: 19985a98f1da6c8ace1a4dc4b46fafddd1e447096935af95d101342e5bb380f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 172ms
58ms Fetch
image/jpeg 44.214.225.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.214.225.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-214-225-221.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/jpeg

GET
H2 200 adsct
t.co/i/ 43 B
625 B 158ms
67ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=1dbd7254-b6ce-42a4-9ce5-11c639ba22b9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6192aa3e-d621-45ab-bfa6-c42864746e6a&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: c3d0aabfccfc451c
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 3ddcf851631cae421311d54023d165a44ebfd1be07130a0bc1198aec0dfff41a
cf-cache-status: DYNAMIC
cf-ray: 8d25ecb2096d7469-MIA
x-response-time: 7
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
214 B 227ms
121ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=1dbd7254-b6ce-42a4-9ce5-11c639ba22b9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6192aa3e-d621-45ab-bfa6-c42864746e6a&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 4d01dc25fffc00f1
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 78aa1717cb7c3a6a0605a97cf26b4de68a81fd6cae59d14cddb6e8cccabd64d5
x-response-time: 76
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 adsct
t.co/i/ 43 B
468 B 196ms
144ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=54878fa4-8cf5-47d5-abd5-a9f18b940bc5&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6192aa3e-d621-45ab-bfa6-c42864746e6a&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 5aef89ae2cb1e4ce
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 009385034b62f7259298c0b7547a99d005175f2cfb4769ead6b364e92ddaa513
cf-cache-status: DYNAMIC
cf-ray: 8d25ecb2096e7469-MIA
x-response-time: 79
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
238 B 177ms
116ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=54878fa4-8cf5-47d5-abd5-a9f18b940bc5&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6192aa3e-d621-45ab-bfa6-c42864746e6a&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 6a68b5c11cad0f44
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 78aa1717cb7c3a6a0605a97cf26b4de68a81fd6cae59d14cddb6e8cccabd64d5
x-response-time: 71
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
760 B 219ms
134ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 0006246af551ba7c7d62d94c08ad8469
x-msedge-ref: Ref A: 35F542E84540465CB8C6838F7708C3A7 Ref B: MIAEDGE2106 Ref C: 2024-10-14T07:41:01Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYkavVRunx9YtlMCK2EaQ==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1728891661028%26li_adsId%3Dce42...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Ft...

0
488 B

203ms
136ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true&e_ipv6=AQKCfk-aWeFTjQAAAZKJ-S0pbKh3hNqdz5BNZj5BVTZNRUchcNZpszOw-c2PaiV0hYMFefY
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: EDDC6D0572AE43F9985F32D0F4A7E271 Ref B: MIAEDGE1721 Ref C: 2024-10-14T07:41:01Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYkavVakFVyXsi+hA1rIw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 14 Oct 2024 07:41:00 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1728891661028&li_adsId=ce42842d-582b-4a08-a9a5-40f28c72133a&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true&e_ipv6=AQKCfk-aWeFTjQAAAZKJ-S0pbKh3hNqdz5BNZj5BVTZNRUchcNZpszOw-c2PaiV0hYMFefY
x-msedge-ref: Ref A: E71D387B320D42B4BD0B0032D6BC6FA0 Ref B: MIAEDGE1911 Ref C: 2024-10-14T07:41:01Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYkavVYT737G7fUpt3suQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 14 Oct 2024 07:41:00 GMT

GET
H2

200

burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6123577...
10104846.fls.doubleclick.net/activityi;dc_pre=CIHjyqqvjYkDFc60WgUdOroMyg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame 5C5E
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-iva...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CIHjyqqvjYkDFc60WgUdOroMyg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-...

0
0

91ms
89ms

Document
text/html

142.250.65.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CIHjyqqvjYkDFc60WgUdOroMyg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6123577713429.3?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2166
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Oct 2024 07:41:01 GMT
expires: Mon, 14 Oct 2024 07:41:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Oct 2024 07:41:01 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CIHjyqqvjYkDFc60WgUdOroMyg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6123577713429.3?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 226 KB
58 KB 186ms
113ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

48ba1993011db4834882d81b2153753437607292f704a6543d4466c0f6d1372a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=4442, tp=9, tpl=0, uplat=51, ullat=0
pragma: public
x-fb-debug: pElAARpG58RKW7277AMrceOs8gTui8MIIomHUnO5DypVQ5Ryc+GNZWglcIWrlYgL4cpwNtguH+2DXmzX13Uybg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 92ms
43ms Script
application/javascript 172.67.163.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "8451e15415563cef4e816d6dd250d58a"
age: 1139
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B2SvDduFkXoaNezzH%2FiAS1AZgtTLQNPB0%2FnSulru1XGoUmLumvy%2BTozH6fh6Y2BfO0s%2ByNDlLGfpe%2F10rkKqyWeFb1Eg2c5b%2F8JdeVNygNg5hh4rkilv2hTxfNpo3k%2F8XIE56uolzP5xAA8%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: cX1KrBhPHgOuREWsAm4rFYw7oa9KvG44SjH8oAUs4BCEkjgF3/ZTJeJIxuGkWYcSsb+mhUmLNtofqP2HV0Vhtw==
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: XQE9JXGX6EVM8GHP
cf-ray: 8d25ecb2c849d9f1-MIA
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
162 B 61ms
61ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=a8fc0ebd-8ff5-4180-915b-d8ce26d3d937&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6192aa3e-d621-45ab-bfa6-c42864746e6a&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 405ca522819a527a
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ae6602ae04c11eed14912ea02318019afce744c98872c113d2905147002b5111
cf-cache-status: DYNAMIC
cf-ray: 8d25ecb279ac7469-MIA
x-response-time: 6
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
392 B 52ms
51ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=a8fc0ebd-8ff5-4180-915b-d8ce26d3d937&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6192aa3e-d621-45ab-bfa6-c42864746e6a&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 93854237ec46d5be
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 78aa1717cb7c3a6a0605a97cf26b4de68a81fd6cae59d14cddb6e8cccabd64d5
x-response-time: 6
content-length: 43
date: Mon, 14 Oct 2024 07:41:00 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H/1.1 200
OK is Show response
54.156.2.105/ 32 B
437 B 232ms
60ms Fetch
text/plain 54.156.2.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://54.156.2.105/is?cb=1728891661068
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=92919375704191140term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 54.156.2.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-2-105.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 0013f717a511e3363ce4e8a170e8471891aa7e883461d2cdaa9d0173a1e8a920

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 1
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 58ms
57ms XHR
text/plain 44.214.225.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=NZlTqtu9vowXrexrDZrWUA&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&t=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&tip=icVri09n9K9cO_7cQ6CkorKTAMzeQsJKy8toFM2CzuA&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-d8c369fc-9b28-56dd-5262-72430621b9e7%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9d8c369fc9b2856dd526272430621b9e72684764b&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKINTBx7vLGq6MGVcMD1rudXKdet5DsK0Q-gyjzIsPbHIKENYBGAQgjJazuAYwAToEQN4Ii0IEQyHK0Q.86lvX43jJMslVIuL5261VLDioLfLiXsraCAMTaaR0vM&sa-user-id-v2=s%253A2MNp_JsoVt1SYnJDBiG55yaEdks.uLuhUJNutO41GjNDJzcruyb9uzSAMPN0U9niFJ8dJTk&sa-user-id=s%253A0-d8c369fc-9b28-56dd-5262-72430621b9e7.s0JJTVI8xHPiBzx%252F%252FHh6pumVXykxxf%252B7kDqoqMVNo9E
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.214.225.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-214-225-221.compute-1.amazonaws.com
Software: /
Resource Hash: e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
content-length: 138
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
39 KB 118ms
33ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?139
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
etag: "632616ff15825f030aab3391a58ef042"
age: 2193
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Mon, 14 Oct 2024 07:04:28 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
x-guploader-uploadid: AHmUCY3j1Sd_n_RyylQ6zfz-IyD6DtW2QIhKeL9rLcGrXfmoF8NpzawiM5W-A5_gPB4w1ujEiROYITDINg
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: MIA-ebd516a
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 39162
server: UploadServer

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 206ms
57ms Image
image/gif 3.94.188.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=4696&prev=b120aa6b-325e-ea1b-b424-32a29460509f&luid=1eea2f21-d2f5-2583-b6a3-99cd8118b879&rnd=42336
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.94.188.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-94-188-245.compute-1.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Mon, 14 Oct 2024 07:41:01 UTC
cache-control: max-age=0
content-length: 34
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 62ms
62ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.170&r=stable&domain=www.fortinet.com&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C82%2C87%2C47%2C46%2C86%2C37%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

0d968e7c57781ed6db034f945eeb2dcd7144e11472d4cb03aaed614c1615e728

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=59, rtx=0, c=68, mss=1232, tbw=67210, tp=62, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: gn3b9vQdR7QKKYODvBaCbnapmsmqUK/0f39iG3Tuf0bAvMJCEqefo29qV8xFaAbfzcfiMyEpDJNP9VV9xMe92w==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 13189
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 utsync.ashx Show response
ml314.com/ 554 B
1 KB 67ms
66ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pv=1728891661472_n7vy90jev&bl=en-us&cb=2846235&return=&ht=&d=&dc=&si=1728891661472_n7vy90jev&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?139
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 28f325e3493c967e6542ad4b48ddc584487e6031b35932f9538258890eb89a7f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 /
www.facebook.com/tr/ 0
269 B 207ms
63ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&rl=&if=false&ts=1728891661538&sw=1600&sh=1200&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.1.1728891661536.952576998207177233&ler=empty&cdl=API_unavailable&it=1728891661457&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=10, mss=1297, tbw=2902, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 238ms
95ms Image
image/png 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&rl=&if=false&ts=1728891661538&sw=1600&sh=1200&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.1.1728891661536.952576998207177233&ler=empty&cdl=API_unavailable&it=1728891661457&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7425533142389322269"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xf77e856888256f1c","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"3":["1473595392721544"]},"debug_reporting":true,"debug_key":"4455363772530905897"}
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: x8Ni6ye7FLy79hL+XgZcvfNVFlXQ/YvRyOi47lNfPuw3NOGRgzmw97/0duQm9BDCgYPSS2z8o3RXZOPk0lnOSQ==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7425533142389322269", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=10, mss=1297, tbw=3215, tp=-1, tpl=-1, uplat=29, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 ibs:dpid=22052&dpuuid=3647695662085046304&redir=
dpm.demdex.net/ 42 B
715 B 62ms
61ms Image
image/gif 35.173.146.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647695662085046304&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.173.146.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-146-122.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v065-0e0ca3f7b.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: XcCqlGSARu0=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3647695662085046304
https://ml314.com/csync.ashx?fp=b1a1155fc2fd084729d512fbd833c1432d3c5e1525a8a51b9cb3ca8e2286f422f4cb09cee1a4f8eb&person_id=3647695662085046304&eid=50082

43 B
56 B

72ms
72ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=b1a1155fc2fd084729d512fbd833c1432d3c5e1525a8a51b9cb3ca8e2286f422f4cb09cee1a4f8eb&person_id=3647695662085046304&eid=50082
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Tue, 15 Oct 2024 07:41:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://ml314.com/csync.ashx?fp=b1a1155fc2fd084729d512fbd833c1432d3c5e1525a8a51b9cb3ca8e2286f422f4cb09cee1a4f8eb&person_id=3647695662085046304&eid=50082
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Mon, 14 Oct 2024 07:41:01 GMT

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=585ddd54-653f-45b5-89a6-52c1a07d3545&gdpr=0&gdpr_consent=

43 B
61 B

66ms
66ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=585ddd54-653f-45b5-89a6-52c1a07d3545&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Tue, 15 Oct 2024 07:41:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=585ddd54-653f-45b5-89a6-52c1a07d3545&gdpr=0&gdpr_consent=
content-length: 241
date: Mon, 14 Oct 2024 07:41:01 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647695662085046304%26eid=2
https://ml314.com/csync.ashx?fp=5834751910482299011&person_id=3647695662085046304&eid=2

43 B
56 B

76ms
76ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=5834751910482299011&person_id=3647695662085046304&eid=2
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Tue, 15 Oct 2024 07:41:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-store, no-cache, private
location: https://ml314.com/csync.ashx?fp=5834751910482299011&person_id=3647695662085046304&eid=2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.75; 38.132.118.75; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 0a5153f5-35de-4002-ace1-b87036417f4a
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 14 Oct 2024 07:41:01 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 76ms
74ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A01%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A00%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223011%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:41:01 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:41:01 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
196 B 81ms
79ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: EB0C8AAD9AEF4050867BB8306A043DB9 Ref B: MIAEDGE1911 Ref C: 2024-10-14T07:41:01Z
x-li-fabric: prod-ltx1
access-control-allow-credentials: true
x-li-uuid: AAYkavVcvY5jW07FInUU3w==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Mon, 14 Oct 2024 07:41:01 GMT
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 75ms
74ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A01%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224015%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:41:02 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:41:02 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 3 KB
2 KB 461ms
114ms Script
application/javascript 35.85.106.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=903817064.1728891659&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221728891658%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221728891659%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22903817064.1728891659%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221728891658.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%228KdtbtLaaXb0xwjQUxa%2Bpw9SoUxO6D%2BO%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1728891658.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221728891658%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221728891659%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=92919375704191140term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=92919375704191140term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.85.106.161 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-106-161.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 97ef0f8e1303f7e143a43b10e78301b2ca05abf3bd8476709d87e85ed71cc91b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 1
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Mon, 14 Oct 2024 07:41:03 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET gs
gs.mountain.com/ 0
0

GET img.gif
b.6sc.co/v1/beacon/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 74ms
73ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A03%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226016%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:41:04 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:41:04 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 6 KB
2 KB 362ms
139ms Script
application/javascript 35.85.106.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=903817064.1728891659&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221728891658%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221728891659%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22903817064.1728891659%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221728891658.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%228KdtbtLaaXb0xwjQUxa%2Bpw9SoUxO6D%2BO%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1728891658.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221728891658%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221728891659%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1728891663489848&shguid=null&shgts=null
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=903817064.1728891659&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221728891658%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221728891659%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22903817064.1728891659%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221728891658.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%228KdtbtLaaXb0xwjQUxa%2Bpw9SoUxO6D%2BO%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1728891658.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221728891658%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221728891659%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=92919375704191140term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.85.106.161 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-106-161.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 1a077a828cf523c604985a4601f726bdf16047fd791ab05db08fd5e2ccfff5ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 23
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Mon, 14 Oct 2024 07:41:05 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 75ms
74ms Image
image/gif 23.200.88.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A04%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227017%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-88-71.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 07:41:05 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 14 Oct 2024 07:41:05 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET generic
match.adsrvr.org/track/cmf/ 0
0

GET /
insight.adsrvr.org/track/evnt/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=390758419.1728891659;ps=1;pcor=441157811;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AAHCD07OGZYAABWr__X1lg

Domain: gs.mountain.com
URL: https://gs.mountain.com/gs

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c&session=b96a9125-079e-41c9-85d8-ed2b3e607280&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2014%20Oct%202024%2007%3A41%3A02%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225015%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=8c321ecf-a20c-4459-8896-45354a11c411&ipv6=2001%3A550%3A1d05%3A1%3A%3A12&v=1.1.29

Domain: match.adsrvr.org
URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=aa142f29-89ff-11ef-bce7-b53eab7a0f13&gdpr=&gdpr_consent=

Domain: insight.adsrvr.org
URL: https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3

Verdicts & Comments Add Verdict or Comment

166 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

121 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 09:00:28	Name: cookiesession1 Value: 678A3E5AF8EB13E5084504F30F5D975F
.fortinet.com/	1970-01-21 09:00:27	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Sun+Oct+13+2024+21%3A40%3A57+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=6.10.0&hosts=&consentId=6561bde4-af91-4887-8cd6-e265245b9ce3&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 04:34:03	Name: demdex Value: 69055857823743530071852983280508792246
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-21 09:50:51	Name: mbox Value: session#ef66e33f9f6647f68e2cc85eac9709e7#1728893519\|PC#ef66e33f9f6647f68e2cc85eac9709e7.34_0#1792136459
.fortinet.com/	1970-01-21 00:14:53	Name: mboxEdgeCluster Value: 34
.dpm.demdex.net/	1970-01-21 04:34:03	Name: dpm Value: 69055857823743530071852983280508792246
.fortinet.com/	1970-01-21 09:50:51	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C20011%7CMCMID%7C68690314511376327431815298513879485502%7CMCAAMLH-1729496458%7C7%7CMCAAMB-1729496458%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1728898858s%7CNONE%7CMCSYNCSOP%7C411-20018%7CvVersion%7C5.5.0
.simpli.fi/	1970-01-21 09:01:54	Name: suid Value: 22F3E13362E54C0097F4EF24E93C1D50
.fortinet.com/	1970-01-21 00:16:18	Name: _uetsid Value: a72569a089ff11ef9335f3a1e6f796d8
.fortinet.com/	1970-01-21 09:36:27	Name: _uetvid Value: a725914089ff11efbf5e0d50fb1e2073
.bing.com/	1970-01-21 09:36:27	Name: MUID Value: 3AAD9C887713605A169F8990767F6112
.bat.bing.com/	1970-01-21 00:24:56	Name: MR Value: 0
www.fortinet.com/	1970-01-21 09:50:51	Name: _gd_visitor Value: db2e4e7e-3f1b-44e2-8c90-a456f05b6e4c
www.fortinet.com/	1970-01-21 00:15:06	Name: _gd_session Value: b96a9125-079e-41c9-85d8-ed2b3e607280
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.fortinet.com/	1970-01-21 02:24:27	Name: _gcl_au Value: 1.1.390758419.1728891659
www.fortinet.com/	1970-01-21 00:14:51	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1728891658829%7D
.fortinet.com/	1970-01-21 09:50:51	Name: _ga_38BQ9XFDT4 Value: GS1.1.1728891658.1.0.1728891658.0.0.0
.fortinet.com/	1970-01-21 09:50:51	Name: _ga Value: GA1.1.903817064.1728891659
.fortinet.com/	1970-01-21 00:16:18	Name: _ce.clock_data Value: 199%2C38.132.118.75%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CUS
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 09:00:27	Name: _ce.s Value: v~58430c8100881a79a97bf1f1eb05668c914d6418~lcw~1728891659168~vir~new~lva~1728891658684~vpv~0~v11.cs~424000~v11.s~a780b2f0-89ff-11ef-af13-8be3e689e329~lcw~1728891659169
www.fortinet.com/	1970-01-21 09:50:51	Name: _omappvp Value: MWcxyXid5REPY1jY8SK2Ewj3D5CtcAkiLJpmQ1kK1woE934mYSS4eaBN5Ruqbbg1I8CU727fOe06OXyE3i1v5OwCdYidLYAG
www.fortinet.com/	1970-01-21 00:14:52	Name: _omappvs Value: 1728891659190
.doubleclick.net/	1970-01-21 04:34:03	Name: receive-cookie-deprecation Value: 1
.doubleclick.net/	1970-01-21 09:50:51	Name: IDE Value: AHWqTUmjQiQ-g9pIPMNpcdpix8oBW1hCWXRyhTpIWYxXnuS6Ajn1by6DO0DlZ6_j
.fortinet.com/	1970-01-21 00:14:53	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
.fortinet.com/	1970-01-21 02:24:27	Name: s_getNewRepeat Value: 1728891659287-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.techtarget.com/	1970-01-21 00:14:53	Name: __cf_bm Value: tEGkAVxW.AR24Qg7wJ2BYBtpZFeMVqTvX8iJjP2UpZg-1728891659-1.0.1.1-fUL3t6E7XCe7dcKLCNNFGJLFEYyRMiVmw7eoAds_tljnoFfKGeo23v5VZhJykGFUW86tCU1m1GDffOW7WzJCCQ
.fortinet.com/	1970-01-21 09:50:51	Name: _ga_JH142QCQCJ Value: GS1.1.1728891659.1.0.1728891659.0.0.0
.www.fortinet.com/	1970-01-21 09:00:27	Name: WID_VISITOR_ID Value: 1728891659009542147
abm-tracking.demandscience.com/	1970-01-21 09:50:51	Name: userId Value: 0ac9c017dfdd772893a32ead8dfce3c5_1728891659753
tracking.contanuity.com/	1970-01-21 09:50:51	Name: userId Value: 0ac9c017dfdd772893a32ead8dfce3c5_1728891659753
tracking.contanuity.com/	1970-01-21 09:50:51	Name: clientId Value: undefined
.bidr.io/	1970-01-21 09:43:25	Name: bito Value: AAHCD07OGZYAABWr__X1lg
.bidr.io/	1970-01-21 09:43:25	Name: bitoIsSecure Value: ok
www.fortinet.com/	1970-01-21 00:24:56	Name: AWSALB Value: d0+iQXghE7s6k8l6lyikY05tc7hX5mnea+6mCRLTAZhQ80IdOZ3+VfEUTtHnmtvpqdc+sdlUdZZQgxL/ZTZFszYPPx2sQtFd+EdzxWfvTlrpEZGkCb9UKVcwaOUbxL1MqFGeBsNE/t8jqQh/JHWqt4NbJtvWLbz0DyGjf64JLJVKe5dFCLPKd9jdGcwYufQTaNMAbmSMKWDEjR0h9/TM72KFZilX1R/Z
www.fortinet.com/	1970-01-21 00:24:56	Name: AWSALBCORS Value: SfT8H6jC6MTPB5k6CSz36WDlnIOUGn5Vs426VuJO6PkmdrW6rfaQx4kSFz1w8fdFfPd2j64F2ieDRkAVfJqyeU1GTVZMKK5tJm3mvGhBvpsGGuvwmOOFOddA1G9AQKDXXBZ2LzUDmGteW/7fLtvg4mF15U8aKgUA/xsUu9B0NcCa31P3JIb9jQEQOiNgbmd26NJwbsc03gHbN3WQJAfgehb5hyOWOIAE
.simpli.fi/	1970-01-21 00:24:56	Name: uid_syncd_secure Value: true
tags.srv.stackadapt.com/	1970-01-21 09:00:27	Name: sa-user-id Value: s%3A0-d8c369fc-9b28-56dd-5262-72430621b9e7.s0JJTVI8xHPiBzx%2F%2FHh6pumVXykxxf%2B7kDqoqMVNo9E
.srv.stackadapt.com/	1970-01-21 09:00:27	Name: sa-user-id Value: s%3A0-d8c369fc-9b28-56dd-5262-72430621b9e7.s0JJTVI8xHPiBzx%2F%2FHh6pumVXykxxf%2B7kDqoqMVNo9E
tags.srv.stackadapt.com/	1970-01-21 09:00:27	Name: sa-user-id-v2 Value: s%3A2MNp_JsoVt1SYnJDBiG55yaEdks.uLuhUJNutO41GjNDJzcruyb9uzSAMPN0U9niFJ8dJTk
.srv.stackadapt.com/	1970-01-21 09:00:27	Name: sa-user-id-v2 Value: s%3A2MNp_JsoVt1SYnJDBiG55yaEdks.uLuhUJNutO41GjNDJzcruyb9uzSAMPN0U9niFJ8dJTk
tags.srv.stackadapt.com/	1970-01-21 09:00:27	Name: sa-user-id-v3 Value: s%3AAQAKINTBx7vLGq6MGVcMD1rudXKdet5DsK0Q-gyjzIsPbHIKENYBGAQgjJazuAYwAToEQN4Ii0IEQyHK0Q.86lvX43jJMslVIuL5261VLDioLfLiXsraCAMTaaR0vM
.srv.stackadapt.com/	1970-01-21 09:00:27	Name: sa-user-id-v3 Value: s%3AAQAKINTBx7vLGq6MGVcMD1rudXKdet5DsK0Q-gyjzIsPbHIKENYBGAQgjJazuAYwAToEQN4Ii0IEQyHK0Q.86lvX43jJMslVIuL5261VLDioLfLiXsraCAMTaaR0vM
www.fortinet.com/	1970-01-21 09:00:27	Name: sa-user-id Value: s%253A0-d8c369fc-9b28-56dd-5262-72430621b9e7.s0JJTVI8xHPiBzx%252F%252FHh6pumVXykxxf%252B7kDqoqMVNo9E
www.fortinet.com/	1970-01-21 09:00:27	Name: sa-user-id-v2 Value: s%253A2MNp_JsoVt1SYnJDBiG55yaEdks.uLuhUJNutO41GjNDJzcruyb9uzSAMPN0U9niFJ8dJTk
www.fortinet.com/	1970-01-21 09:00:27	Name: sa-user-id-v3 Value: s%253AAQAKINTBx7vLGq6MGVcMD1rudXKdet5DsK0Q-gyjzIsPbHIKENYBGAQgjJazuAYwAToEQN4Ii0IEQyHK0Q.86lvX43jJMslVIuL5261VLDioLfLiXsraCAMTaaR0vM
.adnxs.com/	1970-01-21 09:50:51	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 02:24:27	Name: XANDR_PANID Value: tkjS9jiXNDhfFR8qEqIrF3pMBBbksYf_yK0pD2TUzhR8QoV-z07pcwzYM9EH6T5ocwBE4OtcbmHyLTzVJrUZHys15fc0JIWiNi0jCbjoUmU.
.adnxs.com/	1970-01-21 02:24:27	Name: uuid2 Value: 5834751910482299011
.tapad.com/	1970-01-21 01:41:15	Name: TapAd_TS Value: 1728891661151
.tapad.com/	1970-01-21 01:41:15	Name: TapAd_DID Value: 1485500e-97c4-4fd7-9f28-0e834656bb40
.3lift.com/	1970-01-21 02:24:27	Name: tluidp Value: 1808352586918052796546
.3lift.com/	1970-01-21 02:24:27	Name: tluid Value: 1808352586918052796546
.adnxs.com/	1970-01-21 02:24:27	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2C$Qh-MuG!]tbPl1N!7OnM$=BWboh1PVska#ImjcZSocvjGVh/E2[fQh[[ka.[oj6O`RlC)Hq(j#iP(Md+>)fyE9878=
.tapad.com/	1970-01-21 01:41:15	Name: TapAd_3WAY_SYNCS Value:
.openx.net/	1970-01-21 09:00:27	Name: i Value: 2bf79a0a-3a0b-4366-8d1f-ff15d73f2d2b\|1728891661
.smaato.net/	1970-01-21 00:45:06	Name: SCM Value: 1b9ed4174a
.smaato.net/	1970-01-21 00:45:06	Name: SCMinmobi Value: 1b9ed4174a
.smaato.net/	1970-01-21 00:45:06	Name: SCM1001136 Value: 1b9ed4174a
.pubmatic.com/	1970-01-21 00:58:03	Name: KRTBCOOKIE_148 Value: 19421-uid:22F3E13362E54C0097F4EF24E93C1D50&KRTB&23486-uid:22F3E13362E54C0097F4EF24E93C1D50&KRTB&23489-uid:22F3E13362E54C0097F4EF24E93C1D50&KRTB&23539-uid:22F3E13362E54C0097F4EF24E93C1D50
.pubmatic.com/	1970-01-21 00:58:03	Name: PugT Value: 1728891661
.twitter.com/	1970-01-21 09:50:51	Name: personalization_id Value: "v1_WsDmOCHjhN7cjkVzoeaqsw=="
.rlcdn.com/	1970-01-21 09:00:27	Name: rlas3 Value: /YIOPsW6MCzNSXCNgxowHDaEJhIpWk06lc26zXx+tC4=
.t.co/	1970-01-21 09:50:51	Name: muc_ads Value: a66e22c6-e810-4786-affb-cf98d4532c3f
.t.co/	1970-01-21 00:14:53	Name: __cf_bm Value: 1nO0TtX372ByoBTU2oQcgAnGEYgqqRINgd5KIZWubu4-1728891661-1.0.1.1-veVktUgjeh.W3uk0X1QX96DAy3ynWHqwSR7EXH0UT_ydAmnGWXUsDI9By2sz70Jv1qv.xi5LN3UuQ1iHPHgZug
.exelator.com/	1970-01-21 03:07:39	Name: EE Value: "2fda7f7cdaaaa6ab90c28f78912f6b91"
.intentiq.com/	1970-01-21 09:50:51	Name: IQver Value: 1.9
.intentiq.com/	1970-01-21 09:50:51	Name: intentIQ Value: xRJxG2LliC
.yahoo.com/	1970-01-21 09:00:49	Name: A3 Value: d=AQABBA3LDGcCEL0s78TS8UvgpojKLq3sdAAFEgEBAQEcDmcWZ9xH0iMA_eMAAA&S=AQAAAsJAKpJjIVGTa1RMrKb4zm0
.agkn.com/	1970-01-21 09:00:27	Name: ab Value: 0001%3A8%2B2YPKDv8FJmt3mF2poq8oVan%2FjFHxa4
.linkedin.com/	1970-01-21 02:24:27	Name: li_sugr Value: 36e50e8a-cf44-4bcf-8a4d-7b3b7b55c169
.linkedin.com/	1970-01-21 09:00:27	Name: bcookie Value: "v=2&e847c9d3-357c-4416-8454-38fa47e544b0"
.linkedin.com/	1970-01-21 00:16:18	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=3312:u=1:x=1:i=1728891661:t=1728978061:v=2:sig=AQFk1RhwfJVzwwO50X4oxcAknxLgOox4"
.lijit.com/	1970-01-21 09:00:27	Name: ljt_reader Value: JfnNAQZHvCW8WuRQSoKKWBxV
www.fortinet.com/	1970-01-21 00:16:19	Name: aa_cc Value: US
www.fortinet.com/	1970-01-21 00:16:19	Name: aa_cn Value: United%20States
www.fortinet.com/	1970-01-21 00:16:19	Name: 6scexist Value: true
.rubiconproject.com/	1970-01-21 09:00:27	Name: audit_p Value: 1\|Aj/Ht5EveGcLdY/06DUUnIB2v+cd+1iJ6GMqD3UZpvo8fCYmOTvXg2kNc1z3Ruls9ePoZEL0VY5w0S94mtzOHxX1ClJMS060s8vYM4pkAiklccvlHRNbMbsTSjFf/ZLmaS50Y6GrZle/ABVwqkYdBUI5lUNszWF5wP3NzD435qNZYr2f2sSAEVDfv570ZGhx
.rubiconproject.com/	1970-01-21 09:00:27	Name: khaos Value: M28PGFL2-S-139A
.rubiconproject.com/	1970-01-21 09:00:27	Name: khaos_p Value: M28PGFL2-S-139A
.rubiconproject.com/	1970-01-21 09:00:27	Name: audit Value: 1\|Aj/Ht5EveGcLdY/06DUUnIB2v+cd+1iJ6GMqD3UZpvo8fCYmOTvXg2kNc1z3Ruls9ePoZEL0VY5w0S94mtzOHxX1ClJMS060s8vYM4pkAiklccvlHRNbMbsTSjFf/ZLmaS50Y6GrZle/ABVwqkYdBUI5lUNszWF5wP3NzD435qNZYr2f2sSAEVDfv570ZGhx
.rubiconproject.com/	1970-01-21 02:24:27	Name: receive-cookie-deprecation Value: 1
.exelator.com/	1970-01-21 03:07:39	Name: ud Value: "eJxrXxzq6XKLQcEoLSXRPM08OSURCMwSkywNko0s0swtLA2N0sySLA0Xl6UWLVhaWpyaknRoSUVOSU7T6rL4UMd4N0dfT5%252FIZc4ZRfm5qSvAQmGuQYsNjSyX5Bdlpi8KDV5clJLGsKik%252BFTwSZe%252FAPEOK4Y%253D"
.analytics.yahoo.com/	1970-01-21 09:00:27	Name: IDSYNC Value: 176k~2l8v
.intentiq.com/	1970-01-21 09:50:51	Name: CSDT Value: UEQ6MTAwNDNfMCZVUkE1RGMx
.intentiq.com/	1970-01-21 09:50:51	Name: IQPData Value: 646215244#1728891661311#0#1728891661311
.intentiq.com/	1970-01-21 09:50:51	Name: ASDT Value: 0
.intentiq.com/	1970-01-21 09:50:51	Name: intentIQCDate Value: 1728891661312
.pro-market.net/	1970-01-21 00:58:03	Name: anHistory Value: "txbmm3nqvmug+2+!#7%.%7#XJ?"
.fortinet.com/	1970-01-21 09:50:51	Name: nmstat Value: b120aa6b-325e-ea1b-b424-32a29460509f
.bfmio.com/	1970-01-21 09:00:27	Name: __141_cid Value: 22F3E13362E54C0097F4EF24E93C1D50
.bfmio.com/	1970-01-21 09:00:27	Name: __io_cid Value: 44ac7ef811db518fd3d2e538f3835ce81fbae0c5
.linkedin.com/	1970-01-21 00:58:03	Name: UserMatchHistory Value: AQJX7JDYvcmHEAAAAZKJ-SwWXIcSpjnQikm8DHSpQL3Yp9DfmQ_K-2IzteAlIiF02geLGHPBUz5C7w
.linkedin.com/	1970-01-21 00:58:03	Name: AnalyticsSyncHistory Value: AQJiSohBBHN-9wAAAZKJ-SwXbZc-akBMOQfR3UjT0LUaw3M4bp5t92bh4MxPrrYkJG2Ksxrf4XxPHprR3Ep7qA
.crwdcntrl.net/	1970-01-21 06:43:37	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 06:43:37	Name: _cc_id Value: dd4fb88ed4163af77b09de0a0d6710bd
.lijit.com/	1970-01-21 09:00:27	Name: _ljtrtb_2 Value: 22F3E13362E54C0097F4EF24E93C1D50
.ads.stickyadstv.com/	1970-01-21 00:58:03	Name: UID Value: 6ce6b4a9feb28204cbf8e97941317
.ads.stickyadstv.com/	1970-01-21 00:16:18	Name: uid-bp-26865 Value: 22F3E13362E54C0097F4EF24E93C1D50
.pippio.com/	1970-01-21 09:00:27	Name: did Value: LKSkwalQZh6klGlR
.pippio.com/	1970-01-21 09:00:27	Name: didts Value: 1728891661
.pippio.com/	1970-01-21 01:41:15	Name: nnls Value:
.pippio.com/	1970-01-21 01:41:15	Name: pxrc Value: CI2Ws7gGEgYIgr0rEAA=
.agkn.com/	1970-01-21 09:00:27	Name: u Value: C\|0AAAAAAAALp-HjQAAAAAA
.fortinet.com/	1970-01-21 02:24:27	Name: _fbp Value: fb.1.1728891661536.952576998207177233
.ml314.com/	1970-01-21 09:00:27	Name: pi Value: 3647695662085046304
.ml314.com/	1970-01-21 00:35:01	Name: tp Value: 4%253B10%252F14%252F2024%2B07%253A41%253A01
.pro-market.net/	1970-01-21 04:34:03	Name: anProfile Value: "txbmm3nqvmug+1+1f=1+1g=1+1j=57:1+rs=s+rt=200105501D0500010000000000000012+s2=(slc5cd)+vm=24-22F3E13362E54C0097F4EF24E93C1D50:53-CAESEP2g2OoX1eMKWcPHTfSX0-s"
.www.linkedin.com/	1970-01-21 09:00:27	Name: bscookie Value: "v=1&20241014074101a8cb0a08-484a-4bd1-85f9-52490c4b1098AQHT7KlMc2xrB1ZfSv1p6bYLE53RFY_b"
.linkedin.com/	1970-01-21 00:14:53	Name: __cf_bm Value: C8fViHROKJolJAl2nPAwMxcmSmRvwftPl0VitOP_eo8-1728891661-1.0.1.1-7Fq2sqsrdvc6ROMn0lk9WfmIzPUWxb6UJ89Hxz8vPxLxv9I963xn42gYeoFoq3tQrrf0euWokswOugOxVQSEUA
.doubleclick.net/	1970-01-21 00:58:03	Name: ar_debug Value: 1
.rlcdn.com/	1970-01-21 01:41:15	Name: pxrc Value: CI2Ws7gGEgUI6AcQABIFCOhHEAASBQjbThAA
.adsrvr.org/	1970-01-21 09:00:27	Name: TDID Value: 585ddd54-653f-45b5-89a6-52c1a07d3545
.adsrvr.org/	1970-01-21 09:00:27	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCPaozdiyi7Y9EAUYBSABKAIyCwjA1IKFyYu2PRAFOAE.
.ml314.com/	1970-01-21 00:14:51	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.mountain.com/	1970-01-21 09:00:27	Name: guid Value: aa142f29-89ff-11ef-bce7-b53eab7a0f13

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1728891659009542147&event_type=page_request&timestamp=1728891659&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1728891659009542147&event_type=page_request&timestamp=1728891661&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://stags.bluekai.com/site/29931?id=22F3E13362E54C0097F4EF24E93C1D50 Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
ads.stickyadstv.com
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.agkn.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
eps.6sc.co
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
pbid.pro-market.net
pippio.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
px.ads.linkedin.com
px.mountain.com
px4.ads.linkedin.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.inmobi.com
sync.intentiq.com
t.co
tag.simpli.fi
tags.inzynk.io
tags.srv.stackadapt.com
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
v.eps.6sc.co
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
ad.doubleclick.net
b.6sc.co
gs.mountain.com
insight.adsrvr.org
match.adsrvr.org
tracking.contanuity.com
104.19.147.8
104.244.42.3
107.178.254.65
108.138.128.14
13.107.42.14
142.250.65.200
142.250.65.230
142.250.72.98
142.251.32.98
142.251.40.102
142.251.40.130
142.251.40.228
146.75.28.157
157.240.241.1
162.159.140.229
172.67.163.237
18.173.219.118
18.209.125.30
20.33.59.55
216.200.232.249
23.200.88.71
23.46.225.71
23.51.57.192
2600:141b:1c00:209f::1e80
2600:141b:1c00:2e::17d1:48d1
2600:141b:1c00:6::17df:d105
2600:1901:0:8eee::
2600:1f18:1492:1701:a964:c08d:f5eb:b0c
2600:1f18:612b:4200:b056:b715:fbe2:c105
2600:9000:211c:1c00:19:fc2c:a140:93a1
2600:9000:2512:c600:12:dfa9:e200:93a1
2600:9000:2840:1400:1b:5138:8a40:93a1
2600:9000:2840:2a00:1b:6b7d:2300:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::6812:2929
2606:4700:4400::ac40:9b77
2606:4700::6812:1347
2606:4700::6812:572a
2607:f8b0:4006:81d::2008
2607:f8b0:4006:81e::200e
2607:f8b0:4006:81f::2002
2620:1ec:21::14
2620:1ec:33:1::10
2620:1ec:bdf::40
2a02:6ea0:c454::1
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42::485
3.128.169.50
3.225.218.10
3.94.188.245
34.111.113.62
34.111.208.231
34.117.77.79
34.204.30.191
34.238.149.65
34.86.70.109
34.98.64.218
35.173.146.122
35.194.66.159
35.244.154.8
35.71.139.29
35.85.106.161
44.214.225.221
44.226.187.177
50.16.197.56
52.223.40.198
52.32.164.86
52.70.179.249
54.156.2.105
54.159.12.227
54.203.236.163
63.140.39.15
63.140.39.248
63.251.28.211
64.202.112.63
68.67.160.26
68.67.178.10
69.173.146.5
69.194.240.13
75.2.108.141
8.28.7.83
0013f717a511e3363ce4e8a170e8471891aa7e883461d2cdaa9d0173a1e8a920
01f00c0b455f5ebd696d7d8bc51353edcb8a966f20eb48d47ea82dc25daedbe6
03a0fcddc62f902b243bb6ed855041f4fa937340fd81d86552f672f24d6497da
0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0d41c18875dbfc417ec3cdb20d698edd52b930504892fe1e3dd1c0f1ba9b42f7
0d87642c368aa398fe4dd35af439768fb2c9167ba52f2b995eaa3d61598853a6
0d968e7c57781ed6db034f945eeb2dcd7144e11472d4cb03aaed614c1615e728
0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
12860f9b5e19a7620896525dfee0894ebd37e33aacbbeb6c9c97ec973fe7d7b7
17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd
17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c
18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f
188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6
18e04370c6f2bee61d32771663e6b0408e1627bb89a3894457941fa19ad83000
18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1
19985a98f1da6c8ace1a4dc4b46fafddd1e447096935af95d101342e5bb380f3
1a077a828cf523c604985a4601f726bdf16047fd791ab05db08fd5e2ccfff5ed
1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28
1bfc3fec636bdfc92ca324c43dc9382d5f1567b0cb29f806202c2ee530173b7e
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1d3639dfba925efec9bc981060fbc61a5c8b57f54c333b7aa95b8c46b87eb24b
1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566
28f325e3493c967e6542ad4b48ddc584487e6031b35932f9538258890eb89a7f
29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182
2e963b4b8f73348a8de67ca3f24258b1bfc6874339867af3119bd8751ad9db79
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
356fdd586e751109b05f1b9fe931be5e67dad421c507d8b309df252b9c0fafb6
361330b11a948b280cafcb7e36c6653e663491d0c528db10700b0d26c6782269
36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0
3ac2943bf8d9d7f8d3dfa505f1c382b028fa493ffb2e3e2145595815df4ee999
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
4404fc30fd4d13c928a452eb527f304940c70f4726c7e4ee58f7cdc0dd0ca9f2
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909
450be4bf64305ebda12eebbbbdba85912e51497cbb52f921dab64a44310a16b1
48ba1993011db4834882d81b2153753437607292f704a6543d4466c0f6d1372a
4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da
4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
4e9aa67ca1f1ffe2c11e722079a58f1be803c9378468d6c019be53b1ffd26c6b
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
54305fb0b04f504e85e6318bc8671487cb4248b38cd411530bbeff8d8a30ca90
55942e39d9e64b74d3bb291146a1115692ee6d7abe453e982a88b291e65e825d
55efcd9c7c8dc07e65a641a23760facd1b95fa530876ac2d2766e3247764ad3e
5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4
56138472b46ef4a945c8a494b3dd9075d633e5d5216aee94ded521346585eb0a
56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c
5f7c381eca2f132069a8514789e46793cf6f5886b523ac91db7e33c41182248d
5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b
608f95c0544308eaef8ee3554248e93e668f323fb954f584ddc12cd65947d251
61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5
61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5
62ccea4549c1c360f561987e20bd929c475a5f596bc7731a224d99e0d253cfa0
643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32
644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a
661e67a6ed119b9a5bd08892caf68b0e794f68207156cd50f703d320ee6155ef
66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd
71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef
727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4
72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0
7383a414cc9f6ee281f5ccabdee78ab072883d0ce603a8f6a3efa56d1429ee8e
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c
7f47f02c93d5de5de03db0ebffa39fe1060767437b086996e295c9818a05b2f2
80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2
872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7
8c0aa54f351ccf9f614ac7519cec00ae1f40db7bbea8c7dd2fb51538a8d9b272
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8e541dcf6b3eed0334c0309003af2e1851e7cf4d2d881b2f6d79819287fe15e3
8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f
90a224ae782e3be06cc08cd0dea598ea22f91ee4635920cc77228326bb5409d4
92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39
933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
95821af532710ce1b72f0cd8a446d00e30e43aad802c77a0918e0da43d631ef0
9636ce7f4b06bd40058b0417691448095e6490a3b518fbdeac3e104023fd9b92
96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4
97ef0f8e1303f7e143a43b10e78301b2ca05abf3bd8476709d87e85ed71cc91b
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9b7d20ca2f95b29c301c1fa68ad413e59d2a257d129937cc1da942f2f55ffdb4
9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36
9d4563ccb41566b8923320d610edf0aaf3ae71601dc3ee3e9b2e53de47bab913
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a23b68a0964626bb4062bf726dd4ab52d438dcfb88991402b224146d1087d1a7
a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65
a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6
a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5
a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19
b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59
b0c24ca8333c5e792fdbb0d0a02529e99999ae19484c6e304c4cc8ce4535d485
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b563ed473907fc2b2b200f195cec2672be1afc75de48ca5b87aa6079c884f3de
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee
bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c153cd2dff5ec3af05397a2fe0f7dc1eb7544b5858521dca8bf1c20e439d70d4
c50c3a763973b8bc75e126c3f104f84a728f8febf50faa7e37685e86fa1e2c1b
c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d3850813296810130e6341b36b856c6a32e7273ab57f12db7b47a90a61ee72f8
d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5
d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451
d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa
d6dcf3c83210f0829b09bbcd22fbaa7b3427c2313f36567aba12390f96edb983
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359
ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e
edbed558f7bf5f6f28a8eb47251014ecc722ea300f8b11b31d841072ea5e6a88
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6
f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983
f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70
f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3
f46a9869eb1b18c3d0274a6ab46008bb2cfaa73cc3fbb25df8e2d6085ad706da
f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324
f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032
f7e36db0ac9c67d63a232f58f7e6b9610b31c58f0ab9402e4dc500f8c41c05bb
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe2df0ff2352bec1f81fff7ebc21b7a1e6e5795b008f89bcf685490a8357804d

www.fortinet.com Open in urlscan Pro 2600:1f18:1492:1701:a964:c08d:f5eb:b0c Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

236 Requests

85 %HTTPS

30 %IPv6

61 Domains

90 Subdomains

72 IPs

2 Countries

6463 kBTransfer

10289 kBSize

121 Cookies

15 Outgoing links

Redirected requests

236 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Public Scan

Screenshot
Live screenshot

Full Image

236
Requests

85 %
HTTPS

30 %
IPv6

61
Domains

90
Subdomains

72
IPs

2
Countries

6463 kB
Transfer

10289 kB
Size

121
Cookies

236 HTTP transactions
2 data transactions